MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=causas+del+imperialismo+del+siglo+xix+pdf PDF link annotation
- https://volilisaxox.weebly.com/uploads/1/3/1/4/131453747/bajusebobom-veferuxunak.pdfIn PDF document text
- http://zajiledafalam.getenjoyment.net/implement_boolean_function_using_multiplexer.pdfIn PDF document text
- http://tatanip.medianewsonline.com/jixuzaz.pdfIn PDF document text
- https://xutezanepone.weebly.com/uploads/1/3/3/9/133999331/4920db781663.pdfIn PDF document text
- http://winovigamaj.mygamesonline.org/wills_eye_philadelphia_broad_st.pdfIn PDF document text
- https://lataladegizozav.weebly.com/uploads/1/3/4/6/134685495/98c4570a9d0b571.pdfIn PDF document text
- http://lnstagramcentre.net/faseli8t50r.pdfIn PDF document text
- http://dk-inc.xyz/radiology_case_report_impact_factorkayl7.pdfIn PDF document text
- http://xemizawufogutuf.scienceontheweb.net/pibibudaru.pdfIn PDF document text
- http://unosital.space/mastering_astronomy_web_tutorial_answers1szqs.pdfIn PDF document text
- http://cmbespaceclient.xyz/36034851669ptyqf.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://b724dda4-e2e0-47c5-811c-ae3b7273578b.filesusr.com/ugd/a1e5ee_de010d36c18f4123be35ce3d48abf1c0.pdf?index=trueIn PDF document text
- https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_de0ac3283d7a406a94b22783809db26b.pdf?index=trueIn PDF document text
- https://e5baaea7-7007-41de-9367-4ebf3ed55875.filesusr.com/ugd/8e1900_9303fd89ed844e0ebfdebaef70b62522.pdf?index=trueIn PDF document text
- http://pimimozoji.myartsonline.com/pulp_fiction_bible_quote_samuel_l_jackson.pdfIn PDF document text
- https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_40dd442b75574433ac3f70ebc695bdeb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d664539e-d325-4466-95d1-f3316b659658/bejobemilanawuzego.pdfIn PDF document text
- https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_ace1eb43b2f04f4a9225ea229b247651.pdf?index=trueIn PDF document text
- https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_c5916b0be3c8407d86a3c5535a2e948b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e1fbc337-cdf2-47ff-9a91-c016cb9dbf74/2189298459.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011864.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11864 | 5332 bytes |
SHA-256: b2ed5bda8edfa9c92ad0ed6aea5c62e8d2d209a800dbc8e0878f60974cc608c5 |
|||
font_01_sfnt_off00012a72.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12A72 | 12200 bytes |
SHA-256: 385f67b4b6395f40d4365940bb4c91a1a64bb3aaaf7aa321f68317c2bba02716 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.