MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to potentially harmful content. The presence of a UTM term in one of the URLs points towards a phishing or scam campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/aws?utm_term=apple+iphone+5s+battery+problems PDF link annotation
- https://cdn-cms.f-static.net/uploads/4370074/normal_604de53b8f399.pdfIn PDF document text
- https://xelipifexejup.weebly.com/uploads/1/3/4/8/134848770/6074163.pdfIn PDF document text
- https://getikegujobipi.weebly.com/uploads/1/3/4/7/134744553/4834025.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4402963/normal_5ffa43f9b0446.pdfIn PDF document text
- https://xidoferowugefu.weebly.com/uploads/1/3/4/3/134348033/dolarigut.pdfIn PDF document text
- https://kadibunafi.weebly.com/uploads/1/3/0/9/130969561/d309d66.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4455380/normal_5fdd5c4ca6817.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4474456/normal_600bd3d0b34c9.pdfIn PDF document text
- https://wupirevedog.weebly.com/uploads/1/3/4/7/134709422/dipavaxe.pdfIn PDF document text
- https://waxovidimised.weebly.com/uploads/1/3/4/4/134446407/nadexeragukemuw.pdfIn PDF document text
- https://raminatu.weebly.com/uploads/1/3/4/5/134579417/lotarovodipewum-divosafad-larot-motes.pdfIn PDF document text
- https://mawebugejememed.weebly.com/uploads/1/3/4/5/134599942/9796223.pdfIn PDF document text
- https://xuvifadeto.weebly.com/uploads/1/3/2/6/132682806/10b987f49e52.pdfIn PDF document text
- https://rakafofolobe.weebly.com/uploads/1/3/4/6/134649319/wipowozixivada.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_d95652afcb6e4e39b4e559cfe58d6027.pdf?index=trueIn PDF document text
- https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_2c94123f45214f15b639f2f3ed04c75d.pdf?index=trueIn PDF document text
- https://068ba8bc-08b0-4b68-8151-f3c59c7a5775.filesusr.com/ugd/5a4aad_6ae7b895610e46d9be2e1369288add8e.pdf?index=trueIn PDF document text
- https://bf808793-8b46-4c54-8b11-319763181fa0.filesusr.com/ugd/0d018b_32ef0c825b644bdca567616f97e31b1c.pdf?index=trueIn PDF document text
- https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_acf2a8d3199342a19c93fbc1f145ea49.pdf?index=trueIn PDF document text
- https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_0a6bbdde30a34ca7917c8cd79c21064b.pdf?index=trueIn PDF document text
- https://2ac8321c-28d8-41c8-ac7a-99137a6fe030.filesusr.com/ugd/157ee0_667741929b1f49c3a51fa53a5a0e1454.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000105d8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105D8 | 5416 bytes |
SHA-256: 16d87ea57aee431ad9cb9779cfb3f0a45370d8017e5edaae83d9138dcd77e889 |
|||
font_01_sfnt_off0001181b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1181B | 11432 bytes |
SHA-256: 2236e8ffbb5bfb9f4fd768664cd31442d570297d7898dbdec6621f116f13c812 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.