MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous external URIs, many of which point to disposable hosting and are part of a link farm, suggesting a traffic-driving or phishing campaign. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URIs are indicative of a phishing or scam attempt, likely leveraging a fake news lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9976
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=cyberpunk+2077+ps4+update+news PDF link annotation
- https://cdn-cms.f-static.net/uploads/4460243/normal_6024aa9d91cc9.pdfIn PDF document text
- http://bitalotava.scienceontheweb.net/reporodof.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4377380/normal_5fc7ee3e45c2a.pdfIn PDF document text
- http://bukuxojunuz.mypressonline.com/talovowulikodukur.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418368/normal_5fe1875919704.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500425/normal_6039df23371aa.pdfIn PDF document text
- http://mafejaruvoje.sportsontheweb.net/3rd_grade_spelling_bee_words.pdfIn PDF document text
- http://xojuxelase.medianewsonline.com/modal_verb_conversation_listening.pdfIn PDF document text
- http://tevutubiwij.getenjoyment.net/cards_against_humanity_cards.pdfIn PDF document text
- http://vuwagumewaga.iblogger.org/dc_shunt_motor_theory.pdfIn PDF document text
- http://mifilud.iblogger.org/vuzisojajuxulaf.pdfIn PDF document text
- http://pinezotamex.getenjoyment.net/cirugia_ambulatoria.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://nuvavevuk.rf.gd/xisipisaxixolinerapuxet.pdfIn PDF document text
- http://duladujofivar.rf.gd/xutinume.pdfIn PDF document text
- http://tufelurokid.epizy.com/certified_ethical_hacker_v9_download.pdfIn PDF document text
- http://vazubasalax.epizy.com/ketogenic_diet_recipes_free.pdfIn PDF document text
- http://fomobiwudaz.rf.gd/88119600038.pdfIn PDF document text
- http://vejavete.rf.gd/sibapazudafanaxofavixi.pdfIn PDF document text
- http://nekelaxowe.atwebpages.com/au_aw_al_worksheets.pdfIn PDF document text
- http://wovibojo.onlinewebshop.net/63416934407.pdfIn PDF document text
- http://sufotef.rf.gd/woodworking_cabinet_doors.pdfIn PDF document text
- http://xirexadugimog.atwebpages.com/buddhist_meditation_techniques.pdfIn PDF document text
- https://f16fa5c1-8556-4bba-8f86-04d9c108beb0.filesusr.com/ugd/2c3d75_f75a3029c6b4408888baf2f95ec04856.pdf?index=trueIn PDF document text
- https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_635e038a2d284e1c8c033b176605829e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013231.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13231 | 3288 bytes |
SHA-256: 4be34626e3467f56c6d9b8b52fa22b6144430c8b191192ac27be0bd1fc9ef2dd |
|||
font_01_sfnt_off00013dda.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13DDA | 5508 bytes |
SHA-256: d5e9ecb844a91985a0d6928a1e3c40a65375401288d90d6688d93b0e1ce64427 |
|||
font_02_sfnt_off000150c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x150C1 | 11908 bytes |
SHA-256: e86ffd2a4de63eb6b6e10c955e34c12041068ea0561705cce271f0d77c7f5a22 |
|||
font_03_sfnt_off0001794b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1794B | 4324 bytes |
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.