MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The embedded URL, 'https://crophysi.ru/strik?utm_term=comparative+and+superlative+degree+of+much+and+many', is flagged as malicious. The document body, though partially corrupted, suggests a lure related to English grammar to entice users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/strik?utm_term=comparative+and+superlative+degree+of+much+and+many In PDF document text
- https://cdn-cms.f-static.net/uploads/4369671/normal_603e34721a1a9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449014/normal_5fc843d5c5c12.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4457332/normal_5ff05d4732872.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4393514/normal_5ff1914af1236.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384831/normal_5fdb7ee056718.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4529024/normal_5fef69260f89f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424025/normal_606e996ecdf7a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369152/normal_603032781f087.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gurowozenupifi/airdots_xiaomi_manual_portugues.pdfIn PDF document text
- https://s3.amazonaws.com/sinamozagemoger/fesavinivo.pdfIn PDF document text
- https://s3.amazonaws.com/wozowuledij/best_use_of_true_polymorph_5e.pdfIn PDF document text
- https://s3.amazonaws.com/xamibudasagas/heidelberg_catechism_question_and_answer_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9af5e63f-5512-4624-8f05-9913f3566bb9/61017529934.pdfIn PDF document text
- https://s3.amazonaws.com/kaxukok/75226087812.pdfIn PDF document text
- https://s3.amazonaws.com/zulezov/67890441688.pdfIn PDF document text
- https://s3.amazonaws.com/kewuxejikiwe/gitonesexunamiguwo.pdfIn PDF document text
- https://s3.amazonaws.com/niporofez/butesipokumewilekogomux.pdfIn PDF document text
- https://s3.amazonaws.com/wavunot/xuvukitefunuzoligutesuxu.pdfIn PDF document text
- https://s3.amazonaws.com/tawovojo/how_to_replace_lost_driving_license_massachusetts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b688557f-8bd4-40f5-ac85-8bbcd7e218b3/30940193813.pdfIn PDF document text
- https://s3.amazonaws.com/viwoxuz/gabuxivodarozogetajug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/695bfd41-55d3-419d-94c3-46309f9912bc/what_to_do_to_relieve_lower_back_pain_while_pregnant.pdfIn PDF document text
- https://s3.amazonaws.com/kalanejaxutilif/pdf_marketing_management_by_philip_kotler.pdfIn PDF document text
- https://s3.amazonaws.com/takebemanijewok/ararara_song_dj_pagalworld.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/921dbec1-0216-4371-8244-e13ba12b4fc4/sherlock_holmes_story_free_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011019.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11019 | 5636 bytes |
SHA-256: 3eecc0dbdb437de060a996c27ca04a2cf5a03737acf3c597d14143bda102d509 |
|||
font_01_sfnt_off00012320.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12320 | 11500 bytes |
SHA-256: 1122a0f8b6fe10015eb034b83d76cdf7b7a2de1215cc96526bea7b8ce239732c |
|||
font_02_sfnt_off00014a69.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14A69 | 16076 bytes |
SHA-256: daf1883492d64eb2830cc8eabcc582def4ae9ce6a05fcd400af63bb13c14892d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.