MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9970
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=dessler+gary+%25282017%2529.+human+resources+management.+15th+ed.+boston+pearson PDF link annotation
- https://ruzowevo.weebly.com/uploads/1/3/1/4/131453610/suliza_poboju.pdfIn PDF document text
- https://zomoxiwoginu.weebly.com/uploads/1/3/1/6/131637743/5791749.pdfIn PDF document text
- https://safalijig.weebly.com/uploads/1/3/1/0/131070993/nimepap.pdfIn PDF document text
- https://wuvatefowid.weebly.com/uploads/1/3/4/4/134470889/nipofarisuwed_wazirifori.pdfIn PDF document text
- https://kexeretuzigu.weebly.com/uploads/1/3/1/6/131637303/botif.pdfIn PDF document text
- http://sasavojaraw.iblogger.org/64724555239.pdfIn PDF document text
- http://fopijuzege.22web.org/5703715668.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://a1d3e036-d9a1-4be1-9d2f-eedbb581cb22.filesusr.com/ugd/3ce946_a6e20b81667649f38be790495ace12b8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/536dbbc3-856a-4143-a471-a308e3b26f37/64578370328.pdfIn PDF document text
- http://jozixal.epizy.com/72843563954.pdfIn PDF document text
- https://s3.amazonaws.com/baxegezivumi/norse_mythology_gods_tattoo.pdfIn PDF document text
- https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_c5b3df03455a4b6e8e053d8f8fa5e431.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xonobijikivo/bivuwonug.pdfIn PDF document text
- https://de315c38-daa2-4293-b666-e554ba9b7d65.filesusr.com/ugd/564d2e_d6bef46d7fae40b69edb180843065b3a.pdf?index=trueIn PDF document text
- http://zojexajori.epizy.com/10383344794.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a440d7a-998f-4fef-a098-684735ea7d74/sujorarukofeduj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01608fd1-8502-4217-85c7-57876e4db62a/bugijuzudo.pdfIn PDF document text
- http://jufakoxageponuz.rf.gd/abrsm_diploma_candidate_declaration_form.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5343199d-5eb8-46d4-bcdb-a4095b3c1590/85503239370.pdfIn PDF document text
- http://bevunogigofijag.rf.gd/bozutunajexeraxujodata.pdfIn PDF document text
- https://a804c8a8-fdf7-4fba-b19b-c23aecc29597.filesusr.com/ugd/a7074a_88d36032188543e1929f45924218a557.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dupula/mcdonald_s_menu_2018.pdfIn PDF document text
- https://s3.amazonaws.com/bezutu/android_studio_or_bluestacks.pdfIn PDF document text
- http://lutepebenunara.rf.gd/95522909207.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5162e280-1db1-49e0-af3c-37372e680641/32517441624.pdfIn PDF document text
- http://fexomuwitoxe.rf.gd/3912290646.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000110ce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x110CE | 6444 bytes |
SHA-256: a0d75526be93c5422aa028f29ff58c16bede613c86202664f8cf7fc3783cb17f |
|||
font_01_sfnt_off000126be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x126BE | 10720 bytes |
SHA-256: 590d8ae18533f2b98c9294802cc8673d4c348db681ac237dca5147ffc8b26127 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.