MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain 'resalured.ru' that is likely used for phishing or distributing further malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed to host many links on disposable domains, further supporting a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=altered+carbon+resleeved+2+%25E0%25B8%259E%25E0%25B8%25B2%25E0%25B8%2581%25E0%25B8%25A2%25E0%25B9%258C%25E0%25B9%2584%25E0%25B8%2597%25E0%25B8%25A2 PDF link annotation
- http://gepokupaburorew.mywebcommunity.org/inspirational_quotes_for_students_in_college.pdfIn PDF document text
- http://daliadiago.com/basic_seismic_processingf0bye.pdfIn PDF document text
- http://pijojavoto.mygamesonline.org/animation_meaning.pdfIn PDF document text
- http://larokamexi.sportsontheweb.net/fanuvopazezebewape.pdfIn PDF document text
- http://palogaza.sportsontheweb.net/rearrange_pages_sejda.pdfIn PDF document text
- https://cdn.sqhk.co/pajokiman/iaZgdhc/icon_clash_nike_sweats.pdfIn PDF document text
- http://xidasetetobuge.scienceontheweb.net/cholesterol_diet_in_telugu.pdfIn PDF document text
- https://cdn.sqhk.co/videgogaf/bgghage/fozogojaniji.pdfIn PDF document text
- https://cdn.sqhk.co/dosovejozeb/jdicnYz/android_appcompat_actionbar_text_color.pdfIn PDF document text
- http://particulier-societegenerale.xyz/nobatgklv4.pdfIn PDF document text
- https://cdn.sqhk.co/ninilevikod/iit2tjf/84214194533.pdfIn PDF document text
- https://cdn.sqhk.co/wirowanorax/idvrQha/jezuvifejujijozepesu.pdfIn PDF document text
- http://tamakar.xyz/40019128104iypdj.pdfIn PDF document text
- https://cdn.sqhk.co/kigimole/hjhfIhi/44107227984.pdfIn PDF document text
- https://cdn.sqhk.co/bomumuxa/F5vhajh/xanokamuxazoves.pdfIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fad3a94e-c442-4cb4-b759-7ffeb6f54289/wozavusamiwisalesoxipibew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e00a79e-739b-4277-af08-86563ecd07ac/how_to_use_netgear_prosafe_5_port_gigabit_switch.pdfIn PDF document text
- https://s3.amazonaws.com/xeroguru/33117475422.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93d9a23e-c036-46bf-bc3e-83a6d0ce9e3c/how_does_rapid_diagnostic_test_for_malaria_work.pdfIn PDF document text
- https://s3.amazonaws.com/kafises/4186724517.pdfIn PDF document text
- https://s3.amazonaws.com/zunaduxa/instrumen_survei_akreditasi_puskesmas_2016.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e50d58c-327f-4d25-a039-7cc9b26adc26/nosumemifiri.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off000135e7.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x135E7 | 15952 bytes |
SHA-256: cb10e18659579a72f81ea0ddb60bb1cb8fce58ba0cfb90aebf4837c1853eff4a |
|||
font_00_sfnt_off0001120e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1120E | 5252 bytes |
SHA-256: d74b55b1023c7c85b7d6cd4fee256de7cb5289e8092dbec4e468bd553d7dad68 |
|||
font_01_sfnt_off000123f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x123F6 | 6768 bytes |
SHA-256: 2751db959e0dc68e6ffa5f0009ca6fc06b991675eec5f7acd3fde582f95aef69 |
|||
font_03_sfnt_off00016204.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16204 | 11004 bytes |
SHA-256: 908493f85e8e6fc5eb83d92fa4a8db7e6d60b0257b4da6d018ee27c996dca544 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.