MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/wb?keyword=calories%20in%20taco%20bell%20crunchy%20taco%20fresco%20style'. This indicates the document's primary purpose is to lure the user to this malicious site. The ML classifier also strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/wb?keyword=calories%20in%20taco%20bell%20crunchy%20taco%20fresco%20style In PDF document text
- https://static.s123-cdn-static.com/uploads/4467030/normal_5fcef11d46272.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4493873/normal_5ff87d6b2e58e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385424/normal_60627b827bdd1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389384/normal_604ae512a3c87.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4481671/normal_5ffd1bd938936.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4415304/normal_5fc8b6798f7ad.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4375206/normal_5ffdb75dde42e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425917/normal_60254a862ae37.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392668/normal_6066f33cc2515.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/punurum/what_is_narrative_time_definition.pdfIn PDF document text
- https://s3.amazonaws.com/muxozuvalubi/types_of_functional_training_exercises.pdfIn PDF document text
- https://s3.amazonaws.com/kopisigapub/saleforuvuli.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df597db8-aac6-4913-a69d-30154705e631/wuxabudarulut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1b9a5d1-14cb-4744-8ad0-53e23a21872b/universal_audio_apollo_twin_x_duo_thunderbolt_3_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0c5aafe-a0e5-430d-8fbb-7fc4ceb96903/zelotulugezonefelagiwebew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf838b25-35c2-47ee-a4a0-dfc6b1a270c0/dunesizipazebomelifil.pdfIn PDF document text
- https://s3.amazonaws.com/lizuseguwix/teri_meri_bodyguard_audio_song_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8527d136-0b85-4dee-9853-4d8a3cd72dfd/mawoxosorubuxupebefuje.pdfIn PDF document text
- https://s3.amazonaws.com/dazemi/piano_accompaniment_sheet_music_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f0a6ad5-0d85-41a1-9996-f0d413f35e75/whirlpool_edr3rxd1_everydrop_refrigerator_water_filter_3_lowes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bef1b8c2-1606-4b6c-879f-91d33dc6699a/what_are_some_ethical_issues_in_research.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9dd512b9-82b1-4e95-ad87-c9243dbe8a9d/peg_perego_primo_viaggio_4-35_infant_car_seat_in_licorice.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6f8fc3f-da42-4e68-a13b-f3a0189e473e/cuisinart_fondue_pot_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42d44fdb-d947-4692-ba4f-327e0343fcbd/outlook_2016_excel_preview_handler.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f1f8a1f4-6557-4df2-b6c5-b0d2c8e3f33a/how_much_does_a_code_enforcer_make.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46cf6cd3-0702-4765-ab4a-d45d48644dc7/soleus_air_12000_btu_window_air_conditioner_reviews.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010e2c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E2C | 5116 bytes |
SHA-256: bd51da9672fad5a78bee395eaa03a6dbdb2947ff2b1e652afd7ae95dd4ca6a29 |
|||
font_01_sfnt_off00011f95.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F95 | 11728 bytes |
SHA-256: 21ab0007414cc1dbbcf0e725ae7d3e378ca28200b752064f686a9f23643adccc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.