MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=sanger+rainsford+description PDF link annotation
- https://cdn-cms.f-static.net/uploads/4483335/normal_604b14a3cd703.pdfIn PDF document text
- https://cdn.sqhk.co/pinufizugal/bW8ajfQ/my_lips_are_always_dry_and_peeling.pdfIn PDF document text
- https://cdn.sqhk.co/dewufidabo/jaijDyO/34013397210.pdfIn PDF document text
- http://kunewalijaxuna.getenjoyment.net/83994872708.pdfIn PDF document text
- https://cdn.sqhk.co/zugeketinog/lfgfH10/sapavujonebe.pdfIn PDF document text
- https://cdn.sqhk.co/forinabam/cihgfia/71210431954.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455370/normal_60518a77c431d.pdfIn PDF document text
- https://cdn.sqhk.co/nukusigemug/a6hgI6d/xapixi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481275/normal_605382488b2c3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://636e06b3-920c-4898-b827-ef778bbbc101.filesusr.com/ugd/40512e_cea746c4c6bb41ce9c44ed986412e38a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b1fae8f5-1235-4e2b-9bd9-d55576756674/plan_de_estudios_2011_matematicas_primer_grado_secundaria.pdfIn PDF document text
- http://kitilogokufalu.atwebpages.com/88281522836.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0f14a09b-8f40-4515-9f67-c3d2ba530c07/bonodikifaju.pdfIn PDF document text
- https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_fe4ffcea5bf14c0288ec8f647fba5925.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/528ca8bd-1bee-47fa-8a59-092637deab73/how_to_connect_a_afterglow_ps3_controller_to_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/08ec2fa1-487e-49db-813e-6822a2916d79/30911171003.pdfIn PDF document text
- https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_1bd49dc4bcd147cbb91603b29539636a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/af92fbe9-7b0b-4d74-81a1-2a302eff364c/mr._coffee_12-cup_programmable_coffee_maker_black.pdfIn PDF document text
- http://nejimafalun.onlinewebshop.net/tuxis.pdfIn PDF document text
- https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_6c70024bd77544ef8ed3621886760933.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f255f899-5898-4223-bdea-49e27c511fa7/ks_tarot_classic_rider_waite_78_cards_and_the_book_of_mysteries.pdfIn PDF document text
- https://3ff4c494-4984-418a-b709-7a5c611cca0a.filesusr.com/ugd/adbee0_dbd6f8d477ff4c27bef7f5694034a28a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000feb2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEB2 | 5396 bytes |
SHA-256: 9dab8232990dd95c57ce3b7a0df0e3d84ce9936db31a5c1240f24f37b9ee0ae4 |
|||
font_01_sfnt_off00011120.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11120 | 10876 bytes |
SHA-256: 11b16a7e551310d2bda263c49acb8bf89d42a59c067cf9276253930d46c54064 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.