MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, https://fokemale.ru/wix?keyword=us+history+regents+2020+review, is flagged as unknown reputation and is likely part of the malicious infrastructure. The ML classifier and ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/wix?keyword=us+history+regents+2020+review PDF link annotation
- https://cdn-cms.f-static.net/uploads/4379856/normal_604011941056e.pdfIn PDF document text
- http://xugilerasifoveg.22web.org/windows_server_2012_r2_cumulative_update_december_2020.pdfIn PDF document text
- https://cdn.sqhk.co/luwokiseg/Khdiahf/sizabugajusabaridugus.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4385235/normal_5fe33b822bf92.pdfIn PDF document text
- http://femesugubu.iblogger.org/16134297751.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388183/normal_602dab8c8f8f7.pdfIn PDF document text
- https://cdn.sqhk.co/mikevoponage/f99KDhc/foreign_policy_magazine_student_discount.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d177382f-a40b-492c-9980-0541c8ba1803/peavey_vypyr_15w_modeling_amplifier.pdfIn PDF document text
- https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_517aa71951da4bf89a88366dcf94f097.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/52f0e6a8-316d-4a5b-90c3-712c348e416b/filonoxiki.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4f0101c7-d859-4f74-899a-77fdbabb0f37/21832568812.pdfIn PDF document text
- http://zatejufeg.rf.gd/bling_bling_background_vector_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b4fdb85-4672-4659-b002-953bf891f334/10612086654.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1c50168a-996c-4a84-9a71-f522d943d820/21178799936.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd1c8678-b8ec-4b52-a516-abd60dc8d03d/59163229446.pdfIn PDF document text
- https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_01c86048d2f44fe1b5ca3371bd25297b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/aab1647f-58d7-4364-a10d-c85c9dbdff4e/que_es_una_composicion_escrita.pdfIn PDF document text
- https://71fc3d66-43b2-4ae0-adc3-dfbcdf8b5360.filesusr.com/ugd/6605a0_c75abf84b75442a6a30d41b794058dee.pdf?index=trueIn PDF document text
- https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_276048019fb142f29737db5ce7adf41a.pdf?index=trueIn PDF document text
- http://jazoxuxorilule.epizy.com/what_does_the_relative_atomic_mass_number_tell_us.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f81f8aa-c305-430d-ae08-5d4b300a32d4/masterbuilt_sportsman_elite_30_digital_electric_smoker_reviews.pdfIn PDF document text
- http://bevowamudad.epizy.com/awadhesh_premi_ka_dj_song.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001334b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1334B | 5224 bytes |
SHA-256: 947995b73b08dc45626f2e08575dc6ccfde1009f6d02d3ebd00b6687bb0dc7f4 |
|||
font_01_sfnt_off0001452d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1452D | 11156 bytes |
SHA-256: 77e102208cf2b7b720d0b2660bd6792e84fc7b680297b0fa3df5fdff2aa436eb |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.