MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a significant number of external links pointing to disposable domains, indicating a link farm or SEO manipulation attempt. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution. The presence of numerous external URIs and a link farm on disposable hosting reinforces the malicious nature of this document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/123?utm_term=what+are+examples+of+suffix+age PDF link annotation
- http://tapasin.sportsontheweb.net/mezinipovizuxavisorinokov.pdfIn PDF document text
- http://fresh-ita.fun/gangster_wallpaper_girlfz6yr.pdfIn PDF document text
- http://zitupow.medianewsonline.com/troy_the_boy_who_couldnt_stop_eating.pdfIn PDF document text
- http://ver-alex.website/iowa_code_704.6txsnn.pdfIn PDF document text
- https://tonogedufeji.weebly.com/uploads/1/3/4/3/134378200/xuradimavunugor_kelilomejew.pdfIn PDF document text
- http://pugorot.mygamesonline.org/84396931776.pdfIn PDF document text
- https://cdn.sqhk.co/zururodi/hVhdKZV/ice_cream_horror_game_download_android.pdfIn PDF document text
- http://fakaripeti.xyz/what_does_it_mean_when_your_spirit_animal_is_a_tigerbxccc.pdfIn PDF document text
- https://cdn.sqhk.co/fusozuwalas/iaijEif/98085812889.pdfIn PDF document text
- https://pavadugubuwab.weebly.com/uploads/1/3/4/3/134309483/7394654.pdfIn PDF document text
- https://wovuwujofisup.weebly.com/uploads/1/3/1/8/131856276/novajofe_wunejososos_xijavipudonof.pdfIn PDF document text
- https://cdn.sqhk.co/nerutamar/KghVdgi/gopitutexituzit.pdfIn PDF document text
- http://boforotaje.mywebcommunity.org/how_to_program_honeywell_th4110d1007.pdfIn PDF document text
- http://lnstagram-help-businesss.com/dark_ghetto_kenneth_clarki5b2r.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://8767aa75-4bd5-48c0-94ca-24e983238001.filesusr.com/ugd/debdc1_952574e20c5c474da8819eeb591c9b16.pdf?index=trueIn PDF document text
- https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_5f4f501df92441e2a25219e9ebcf64de.pdf?index=trueIn PDF document text
- http://wuragumok.atwebpages.com/xilakupamisapitigejawaz.pdfIn PDF document text
- https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_e7707829b5bd421d9ab53a0dcc89a77a.pdf?index=trueIn PDF document text
- https://da9d63b4-fbfd-4f6f-88e7-06ac0d76355b.filesusr.com/ugd/ca300b_5e24c05402c8482e819fd688918a7a43.pdf?index=trueIn PDF document text
- https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_7a53b01dbf25455da02ebdc231405fc2.pdf?index=trueIn PDF document text
- https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_b6ab3d9d5f354ce3a12b8d27f2135f85.pdf?index=trueIn PDF document text
- https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_708cb098ba8c490797748f03801b6ead.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3f9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3F9 | 5396 bytes |
SHA-256: da5ea807945fd92cb84db36ef0d27748002784aea7516a9c0fde6692a7148455 |
|||
font_01_sfnt_off0001063e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1063E | 10588 bytes |
SHA-256: e5aeaa9b10cade51ea4826dbbb0757227c60ca2b0e42dba89576dc0dcf3b043b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.