MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.6656
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://podar.co.za/XSRYdR1H?utm_term=gunlance+iceborne+guide PDF link annotation
- http://modernplating.com/userfiles/file/605474685.pdfIn PDF document text
- http://vladjurnalist.ru/archive/file/fejaxisasudi.pdfIn PDF document text
- http://hamzalegalservices.com/userfiles/file/liwom.pdfIn PDF document text
- http://drcleancenter.com/uploads/files/202202231821029655.pdfIn PDF document text
- https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/fvfmesdm2rafvj62bsg9t81nog/55672309916.pdfIn PDF document text
- http://www.look4job.gr/images/_user_na/file/58746027688.pdfIn PDF document text
- https://bonvoyageindia.in/ckfinder/userfiles/files/65188818636.pdfIn PDF document text
- http://look.bio/kcfinder/upload/files/zogudozagibanoxuzotula.pdfIn PDF document text
- http://azv-goldeneaue-uthleben.de/kcfinder/upload/files/65914670695.pdfIn PDF document text
- http://thermcom.cz/userfiles/file/42328151300.pdfIn PDF document text
- https://lifesmart.ro/ckfinder/userfiles/files/gikexotazewi.pdfIn PDF document text
- http://robertfeinberglaw.com/images/edit_images/file/79478000165.pdfIn PDF document text
- https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/400b18bc436b58ed46b0d59ca4b9663e/65277728965.pdfIn PDF document text
- http://citranco.com/users/files/revajakadapifuvatadiv.pdfIn PDF document text
- http://tomrerjm.server2.dk/userfiles/file/zokamotaxob.pdfIn PDF document text
- https://corpusbg.com/files/fck/file/32676228795.pdfIn PDF document text
- https://exhibitproplus.net/mentorfinancial/page_images/file/85078505962.pdfIn PDF document text
- http://culfordequestriancentre.org/UserFiles/file/fuliwi.pdfIn PDF document text
- http://shinhwajudan.com/userData/board/file/kavebe.pdfIn PDF document text
- http://stroi-sistema.ru/img/7010179992.pdfIn PDF document text
- https://holycrosshealthcare.com/userfiles/files/72044732370.pdfIn PDF document text
- https://fancybox.pamlskovnik.cz/ckfinder/userfiles/files/8499246310.pdfIn PDF document text
- http://comlark.ru/userfiles/files/43455662098.pdfIn PDF document text
- http://yeke.com.tr/public/kcfinder/upload/files/tiguxojumigosapivunijel.pdfIn PDF document text
- https://csn-alliance.com/data/files/71010141452.pdfIn PDF document text
- http://egyptfuture-eg.com/public/kcfinder/upload/files/kevodajiruwaradepen.pdfIn PDF document text
- https://thebottombillion.com/business_school/uploads/file/xopiwusisula.pdfIn PDF document text
- http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/zuwotitak.pdfIn PDF document text
- https://vas-vill.hu/userfiles/file/xajunomagawewovinagupo.pdfIn PDF document text
- https://habibitours.com/ckfinder/userfiles/files/nabokobid.pdfIn PDF document text
- http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620bbcb0e8598---geraxevizefusewapalit.pdfIn PDF document text
- https://unitedfightalliance.jordanadams.com/ckfinder/userfiles/files/54313667819.pdfIn PDF document text
- http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/16226746976592---rexapurikel.pdfIn PDF document text
- http://biblebaptist.kr/user_data/kcfinder/files/35657949132.pdfIn PDF document text
- http://dental-forum.ru/userfiles/file/bipudefikedarigulema.pdfIn PDF document text
- https://nacituran.com/userfiles/file/5150309464.pdfIn PDF document text
- https://derya.afmiletisimajansi.info/resimler/files/gimulexutopezomoxarop.pdfIn PDF document text
- http://wpchkg.com/upload/image/file/1728241819.pdfIn PDF document text
- http://ukicda.com/admin/fckeditor_upfiles/file/2022020121154180554.pdfIn PDF document text
- http://cityclick.it/userfiles/files/winisi.pdfIn PDF document text
- http://tanphatinst.com/vietkiendo/upload/file/96386451269.pdfIn PDF document text
- http://rbn.org.np/public/admin/plugin/kcfinder/upload/files/20682414070.pdfIn PDF document text
- http://penzionnakrizankach.cz/ckfinder/userfiles/files/22915348756.pdfIn PDF document text
- http://connectcontrol.net/files/userfiles/files/punodusizanubuxa.pdfIn PDF document text
- http://study4student.com/cache/fck_files/file/86910403227.pdfIn PDF document text
- http://supragyn.cz/userfiles/file/wuterala.pdfIn PDF document text
- https://huaku3c.tw/uploads/files/202202101357293889.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
+6 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00044f30.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x44F30 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_01_sfnt_off0004664b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4664B | 19108 bytes |
SHA-256: 88b54fa3b66ec67ede04e7439d38e0080b94fa0c975a661b30adbd50b0892699 |
|||
font_02_sfnt_off000498c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x498C1 | 10556 bytes |
SHA-256: 3e9174286e5b7cc5addafda56259b092d88cc205194ad5ed6b8153b30e17609e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.