MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document is designed to host numerous external links, with 'soxebez.ru' and a Weebly-hosted PDF being prominent examples. The presence of embedded URLs and the nature of the heuristics point towards a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/123?utm_term=ajooba+movie+full+hd+video+songs
- https://remitibomuko.weebly.com/uploads/1/3/4/8/134853657/d8b893.pdf
- https://static.s123-cdn-static.com/uploads/4464078/normal_5fcdd952aa5ac.pdf
- https://finudekenituw.weebly.com/uploads/1/3/6/0/136053274/vosezitimifutovi.pdf
- https://cdn-cms.f-static.net/uploads/4482617/normal_5fd8100c5575d.pdf
- https://jumojebanofoz.weebly.com/uploads/1/3/5/3/135302369/6530341.pdf
- https://xudomulur.weebly.com/uploads/1/3/4/0/134040538/5780667.pdf
- https://cdn-cms.f-static.net/uploads/4366312/normal_603ab05a06def.pdf
- https://woxogobigevi.weebly.com/uploads/1/3/0/8/130814596/6861901.pdf
- https://cdn-cms.f-static.net/uploads/4427077/normal_60272450e8ae4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/pekatikisuruki/layered_architecture_in_computer_network_in_hindi.pdf
- https://s3.amazonaws.com/sizadagazagaj/twilight_saga_part_2_full_movie_in_hindi_dubbed_download.pdf
- https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_1d29a9675c29419fb280cc31d3e70b34.pdf?index=true
- https://8bd0dbf5-62e0-4684-a95a-1d9666dfa34a.filesusr.com/ugd/e71694_2efd4cd5167542ee90b7f82b86818a1f.pdf?index=true
- https://s3.amazonaws.com/roxawo/lumudufevasinopidatabub.pdf
- https://s3.amazonaws.com/piradi/templates_materialize_css.pdf
- https://s3.amazonaws.com/zopenave/boone_and_crockett_score_sheet_black_bear.pdf
- https://s3.amazonaws.com/dozuga/service_cloud_consultant_certification_study_guide.pdf
- https://s3.amazonaws.com/gurafoga/59638347949.pdf
- https://s3.amazonaws.com/wujapu/dental_trauma_guidelines_subluxation.pdf
- https://s3.amazonaws.com/purawuma/barbie_doll_ki_photo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fe89.binb8c8d6f7bd8ed0ec52e51c3b37ec7826d4b17dbe518619711e67fb0083cca009 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE89 | 5292 bytes |
font_01_sfnt_off0001106b.bineb4f143a8e346f94ee389ffe8394f07312878b2e74c8c13c01094d80b3330471 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1106B | 12052 bytes |
font_02_sfnt_off000138a4.bin1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x138A4 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.