MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to 'oniceh.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, contains text related to 'Adobe illustrator cs6 serial number validation' and 'wkhtmltopdf', suggesting a lure to trick users into visiting the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/pbw?utm_term=adobe+illustrator+cs6+serial+number+validation PDF link annotation
- https://cdn-cms.f-static.net/uploads/4388413/normal_6059ad53bffcc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379842/normal_6041fb8dd9622.pdfIn PDF document text
- https://pedomolakikivo.weebly.com/uploads/1/3/4/4/134440841/4d59dc102194f10.pdfIn PDF document text
- https://gaxasonazeg.weebly.com/uploads/1/3/4/3/134375181/lelimu-niwetowosa-difinu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417216/normal_6048273b38132.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459463/normal_60b8558ea751e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449781/normal_5fef0bf71ee33.pdfIn PDF document text
- https://sobuxiba.weebly.com/uploads/1/3/4/8/134867950/c7f43a7f253.pdfIn PDF document text
- https://fedofiri.weebly.com/uploads/1/3/2/6/132681193/wimefonuv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470540/normal_60170aa392a3c.pdfIn PDF document text
- https://liburesaxus.weebly.com/uploads/1/3/4/3/134372769/663caf20b78ca.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/983d6ead-75ef-4e73-80fb-bddad5585a96/can_your_body_repair_itself_after_quitting_smoking.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/679e0885-3b09-4e4a-9ba2-015a9e9ca84d/universal_audio_apollo_twin_x_duo_used.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d9f8094-17d2-4a62-a538-f1396cdf2af3/corporate_social_responsibility_definition_economics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66021514-56c4-4d47-ae04-aa8a0b16a992/carpentry_courses.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96784d7c-5c97-4499-8bd7-25b1e3848372/nazafenoladigakurezegosig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c902d459-6b31-413c-b1a3-516c55d4aa21/how_to_hard_restart_kindle_fire_8.pdfIn PDF document text
- http://damopijos.pbworks.com/w/file/fetch/144515214/sodufugob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1ded63a6-3c24-47c2-bd19-3d7994063d2f/descargar_libro_tu_puedes_sanar_tu_vida.pdfIn PDF document text
- http://garifukedako.pbworks.com/w/file/fetch/144426777/33885078425.pdfIn PDF document text
- http://wufamazajo.pbworks.com/f/how_to_promote_equality_diversity_and_inclusion_in_the_classroom.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee49.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE49 | 5428 bytes |
SHA-256: fb194f57bc158f2a4082e2a12e9ba9cbf900eaf6f5499e29f256497ab18715b0 |
|||
font_01_sfnt_off000100a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100A9 | 11076 bytes |
SHA-256: 32ebf7ad70fec9ec0993724167444b2dd083d471ec4929dcd747098e99679e6d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.