MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically a phishing or trojan distribution. The embedded URLs, such as 'https://baarspo.ru/strik?utm_term=lowrance+elite+7+ti2+combo+manual', are likely used to redirect users to malicious sites. No scripts were extracted, but the PDF structure and link farm behavior are indicative of a phishing or malware delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=lowrance+elite+7+ti2+combo+manual PDF link annotation
- https://fexalikinuzumow.weebly.com/uploads/1/3/5/3/135324316/366d9.pdfIn PDF document text
- https://rimokukesezawuk.weebly.com/uploads/1/3/1/4/131437069/27520c5bfe9.pdfIn PDF document text
- https://nulosumewure.weebly.com/uploads/1/3/4/6/134645663/jiwipovupor.pdfIn PDF document text
- https://viwoseloza.weebly.com/uploads/1/3/4/8/134861971/kisokesigatiwiku.pdfIn PDF document text
- https://tagorawijetix.weebly.com/uploads/1/3/5/3/135392874/lapepulilenaxa-rotizuvuzubimuv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/21e77d50-d06c-45ab-a3ba-de559d2c4a26/how_to_tell_if_an_electrolyte_is_strong_or_weak.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd8a0013-588c-4022-9122-b400e5d2855a/viparenimizobo.pdfIn PDF document text
- https://s3.amazonaws.com/kudowo/binizebopikuro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7dfd7c4-fda7-40e2-b186-89918f3fd322/best_choose_your_own_adventure_books_6_year_olds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d10a8f1-8982-4a52-abb0-68e34923a75c/temaditezetit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0890f408-d896-4930-8d3d-ddae2dfdfde4/23714158630.pdfIn PDF document text
- https://s3.amazonaws.com/sesafefanulokam/rizixoxokixekasesafajizi.pdfIn PDF document text
- https://s3.amazonaws.com/vuterijoze/lekegumunutatugevitit.pdfIn PDF document text
- https://s3.amazonaws.com/nademopor/mcsa_server_2016_complete_study_guide.pdfIn PDF document text
- https://s3.amazonaws.com/lonozote/machine_learning_bootcamp_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c643ee35-4c04-4479-85f3-8b5dec496c3f/washington_dc_population_2019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/426e4c12-fbfd-41ae-8d74-a0ec6ff2333e/bob_revolution_pro_duallie_double_stroller.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91183b8c-21a8-495d-8ce9-5a2233e70bf3/83602304667.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58b8d5c3-b732-4341-ad25-e506aefa2adc/58281387096.pdfIn PDF document text
- https://s3.amazonaws.com/wixanarer/rivujixokatuwuduzapedomen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ac311ef-8da8-4ad0-bdbb-8ed24dc760b7/25486444075.pdfIn PDF document text
- https://s3.amazonaws.com/zarelusipofox/structural_adjustment_programs_in_zambia.pdfIn PDF document text
- https://s3.amazonaws.com/fusopoxipo/security_self_storage_tryon_road_raleigh_nc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eff32af9-d922-47b1-a8ec-b5af1dd1d1b4/aroma_professional_rice_cooker_4_cup_instructions.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f772.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF772 | 5152 bytes |
SHA-256: 45d2ecdd60a7a963ca43f01d1d8d9d6cf520c7e1c8d670c2bf64fc00149d5ee5 |
|||
font_01_sfnt_off00010901.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10901 | 11048 bytes |
SHA-256: c018474e34bc90e10a71c7d65525a92c0cb10eab8826e56b98f53a89a610581e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.