MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including a critical alert for linking to known malicious redirector infrastructure and a machine learning model indicating high maliciousness. The embedded links, such as 'https://yafferge.ru/123?utm_term=autocad+online+no', are designed to direct users to potentially harmful sites. The document's structure and the presence of numerous links suggest a phishing or malware distribution attempt, masquerading as a resource related to 'Autocad online no'. No scripts were extracted, but the PDF's nature strongly implies a malicious intent to redirect users.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/123?utm_term=autocad+online+no In PDF document text
- http://wwnews.site/mirejopu7mswv.pdfIn PDF document text
- http://gafegenuwegapok.iblogger.org/dezozapu.pdfIn PDF document text
- http://fupefabesosada.mygamesonline.org/achilles_tendonitis_rehab_exercises.pdfIn PDF document text
- http://kozidozilujivox.getenjoyment.net/vilamaladirimenanemon.pdfIn PDF document text
- http://rivepozepuxar.mywebcommunity.org/20462978688.pdfIn PDF document text
- http://zootime.store/material_ui_button_form_submit9gk7b.pdfIn PDF document text
- http://enots.space/kogonifogesgbgnc.pdfIn PDF document text
- http://nitajikiwijofo.22web.org/vijigabawakowanulukozalik.pdfIn PDF document text
- http://labiosdewonda.com/need_for_speed_most_wanted_ps2341i6.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/87d1737b-95c6-4db7-b85b-adbcff59e790/53274590632.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/41e93484-602a-4107-b668-8f8e243ca35d/taxesetakaf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd0a5ec4-b3f4-4cb5-9a3a-e130ff968154/pududanaxilevosigatinizeg.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a1d96eb-571b-4a1f-8583-d4abf32b36a9/38684728472.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/632fb69b-5765-43f5-8155-985d93112b99/16033501110.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d4730a0-be88-4d55-b175-e88f370daff7/75265141823.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73f0db1b-c0b1-4808-88ef-d33b7fd55666/free_palm_reading_app_no_subscription.pdfIn PDF document text
- https://s3.amazonaws.com/kiremefegonar/tutoso.pdfIn PDF document text
- https://s3.amazonaws.com/varoximu/reading_comprehension_worksheets_for_3rd_grade.pdfIn PDF document text
- https://s3.amazonaws.com/fowonaxul/dikovebabelipajerotum.pdfIn PDF document text
- http://polilofu.onlinewebshop.net/interview_questions_on_dbms_and_sql_with_answers.pdfIn PDF document text
- http://puferug.rf.gd/lonelojewibeduf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/414e3c8a-e499-4929-83dd-f3cec4d3bff8/13112393117.pdfIn PDF document text
- https://s3.amazonaws.com/satudifin/99195071820.pdfIn PDF document text
- https://s3.amazonaws.com/jalasilunaz/xijazixoz.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8d4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8D4 | 4648 bytes |
SHA-256: d38ad0ff1c21353c818ec99fc5056ef7c80676429168bcbf1a166cad7fdc2f62 |
|||
font_01_sfnt_off0000f8b8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8B8 | 25624 bytes |
SHA-256: 7d6a316d9a543c6714789b6749f0e03bc44600f8c423c3705ec741ed7c9412f9 |
|||
font_02_sfnt_off00012f3a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12F3A | 16204 bytes |
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.