MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/wix?keyword=lee+harding+goodyear PDF link annotation
- http://f13x.xyz/talixetoxexoled7fxdj.pdfIn PDF document text
- http://just-gopro.com/pojavenipasomejojeww9gx8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371240/normal_5ffebb7273817.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371509/normal_6021bda8541b6.pdfIn PDF document text
- http://lnstagram-copyright-supports.com/42769477062g9x6w.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4485321/normal_5ff8cbb6f1718.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_293247e5a68c4518ac789ff75838ea96.pdf?index=trueIn PDF document text
- https://5e20aa6b-77ef-4f11-9344-5454fb7c649c.filesusr.com/ugd/fb3aa9_7ab7a57a49dc488d8be1df3b71d0af88.pdf?index=trueIn PDF document text
- https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_915dc741e84645faafdec5e9db0e2f01.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/74583e6b-d267-4fd7-80dd-46dd78c7b32e/english_speaking_class_for_adults.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6b60772a-c80a-4ab8-a3c2-1202577d0175/5_love_languages_quiz_free_goodnet.pdfIn PDF document text
- https://77a80da1-97a3-4b40-ba11-54c6d232eb66.filesusr.com/ugd/39a0fd_09b36d26ac1945c7a616331afa58098d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/145fb1d0-cd0c-44d3-9390-324ab111d8d6/cuales_son_los_pronombres_relativos_en_ingles_y_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1237da24-e70d-40d0-866d-c2dca18d1325/what_are_the_new_html5_tags.pdfIn PDF document text
- https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_0325effbc0ff4c34bc12b687a049996e.pdf?index=trueIn PDF document text
- https://f0f855fd-29d2-4bf6-9fdd-af1de8d1f91d.filesusr.com/ugd/184831_f82beca3ad654ee09aaf8b1473705cba.pdf?index=trueIn PDF document text
- https://c18d7360-3707-4bf1-9d6f-52ba7510fa17.filesusr.com/ugd/76cb06_fbfb24c1f7e245f892d204d1eac5fac0.pdf?index=trueIn PDF document text
- https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_043ab7fe46da4081b84e2548bc2df447.pdf?index=trueIn PDF document text
- https://18aefb47-0221-41c7-ace0-4f78eb33e730.filesusr.com/ugd/bca722_4e8fe47db1b84b71924619851f46ebb4.pdf?index=trueIn PDF document text
- https://50037ee0-0691-4a53-bdc2-b2f8f795cfa6.filesusr.com/ugd/b41a9a_93ca385666eb4ca1b1c3dbdbc875884b.pdf?index=trueIn PDF document text
- https://311919ef-92bb-434b-a93e-382c1a5e2e65.filesusr.com/ugd/c893b4_3f6f00dad095446898206b357b648204.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010c72.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C72 | 4920 bytes |
SHA-256: f8e228d7f92520d55aa9eb82f54ef4a66bc711028d603a750a2ddf66881d6deb |
|||
font_01_sfnt_off00011d30.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D30 | 11740 bytes |
SHA-256: ea209d4b22c17eff28bee21d2e7a884668dde5a94c69d3cc2c1b8bd021ce9ffa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.