MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable hosting, indicating a link farm or redirection scheme. ClamAV and ML classifiers identified the PDF as malicious, specifically a phishing or trojan variant. While no scripts were extracted, the PDF structure and heuristic firings suggest an attempt to direct users to potentially harmful external sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=does+casio+wave+ceptor+work+in+india PDF link annotation
- http://albatros-trans.ru/how_to_change_setting_on_resmed_s9oylaa.pdfIn PDF document text
- http://pebimubegema.22web.org/vaniwojabajibonupakaned.pdfIn PDF document text
- http://disclosures.space/dudijesozizvi.pdfIn PDF document text
- http://xxlmature.site/latest_electrical_electronics_engineering_jobs_in_nigeria38orb.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://lofenabowebezuk.epizy.com/android_platform_based_linux_kernel_rootkit.pdfIn PDF document text
- https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_c95aa00c405d4500a22b0a1224e9a110.pdf?index=trueIn PDF document text
- https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_3f1b1b3b66574c7f952b6d9f24bcc3aa.pdf?index=trueIn PDF document text
- https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_fd8f03e6e9d347989cdf3188a5ba62ad.pdf?index=trueIn PDF document text
- https://8a6b9437-e7f2-49d7-8c24-351b272aa67a.filesusr.com/ugd/b18e4d_9355672f68614d7d9b9dab89abd8bf6a.pdf?index=trueIn PDF document text
- https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_5885c76aa8154e1c80f953225b1ce239.pdf?index=trueIn PDF document text
- https://6bb2b61b-82bf-473b-8365-63ddb02ddbdd.filesusr.com/ugd/d55797_47f1a9746fa24cbb80d887bea6e9a050.pdf?index=trueIn PDF document text
- https://a871512b-322e-4980-b372-fd74ba483995.filesusr.com/ugd/607883_af4effc349ed4a54b54b00a25e7738c8.pdf?index=trueIn PDF document text
- https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_3b3076295e974a4a847a4fcf1043ee2b.pdf?index=trueIn PDF document text
- https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_c4d485914eb84a68a9a628b422ab53f5.pdf?index=trueIn PDF document text
- http://rogofijanititad.epizy.com/falsifying_police_report_claim.pdfIn PDF document text
- https://s3.amazonaws.com/zidosozawok/xodatoga.pdfIn PDF document text
- https://s3.amazonaws.com/jevedijadiki/bonufuwuri.pdfIn PDF document text
- https://s3.amazonaws.com/norozovijalu/24296255670.pdfIn PDF document text
- https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_1232a4fb059b44669b5ef620a2777e3a.pdf?index=trueIn PDF document text
- http://fedifag.epizy.com/wifemulad.pdfIn PDF document text
- https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_550b4cc7b9aa4a359eb19bfadebf186d.pdf?index=trueIn PDF document text
- https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_a758193b5f6847468ba1be109aefccf0.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f0ae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0AE | 5248 bytes |
SHA-256: 0d6504c2d1913d7d0d45401606999f4a26c64d1773b7ce175c24857693a1a3a8 |
|||
font_01_sfnt_off000102bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102BF | 11296 bytes |
SHA-256: 0b2f56198bc5a6d6956afa24e7c64405ab2884f02a9adb1b314121f88958685b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.