MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external URLs, with a primary focus on directing users to 'bologen.ru' via a query related to phone connections, likely a lure. The PDF's structure and embedded links suggest it functions as a link farm designed to redirect users to potentially malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/strik?utm_term=how+many+phones+can+connect+to+ooma+telo PDF link annotation
- https://cdn-cms.f-static.net/uploads/4444638/normal_6029d17249300.pdfIn PDF document text
- https://cdn.sqhk.co/xakurusuk/l7C5jhW/viwasijunapiwofedaraz.pdfIn PDF document text
- http://ezfix.asia/cricket_tournament_registration_form_2020n2dc9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4408586/normal_5fcf8558e3626.pdfIn PDF document text
- http://parazepurafeza.medianewsonline.com/arthur_andersen_case_study.pdfIn PDF document text
- https://cdn.sqhk.co/fuzomorikat/HnQbhg8/kaiser_permanente_provider_login_oregon.pdfIn PDF document text
- https://cdn.sqhk.co/puvegipuros/HoiGhbi/95151978960.pdfIn PDF document text
- http://bnl-jobs.com/tinitiburefuvonoxers50x.pdfIn PDF document text
- https://cdn.sqhk.co/delotijuw/gcwidih/real_steel_signs_phone_number.pdfIn PDF document text
- http://serawuv.mygamesonline.org/ferulic_acid_derivatives.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4463529/normal_6047d85144b93.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4424376/normal_5feff6484cae0.pdfIn PDF document text
- http://fifamarketbot.com/ahlam_mosteghanemi_nissianrj4zr.pdfIn PDF document text
- http://pirunumilusarib.sportsontheweb.net/72_angels_of_magick.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4478932/normal_5ff692ea7de9b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fb7965fb-b0d9-46d0-befc-f7dfb1e8e592/kedetobugipaj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/daec16eb-a57b-4fd4-a6bf-4e7a66274def/30262925646.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/313ef324-0f06-417d-8862-e6b59783114c/90385698146.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dcb79cb3-990b-4eaa-b8c4-9b3c0a810480/womens_nike_air_force_1_pixel_ghost_aqua.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db6e33a6-ce86-4314-93be-8263b04eae05/clases_de_comunicacin_para_tercer_grado_de_primaria.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1762c0a1-0b39-4d55-bd6d-d91fc1b69827/89454741205.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/497be354-d755-4a42-a2f4-91c112675b42/how_to_deep_clean_crane_humidifier.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/748da3ae-565b-44bf-bd5c-c66dd1957afe/subesawabisixodexekiba.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eab7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAB7 | 5232 bytes |
SHA-256: 028f1f9aab39d9b47d23268a7649cfa464e3021e80e6ed0b03bf9eb375d24c09 |
|||
font_01_sfnt_off0000fc75.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC75 | 10284 bytes |
SHA-256: faa061d27a489f459a8180b7938be1f46dd38248cc8387bd9cb40fbaf53fbef7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.