MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains a large number of external links, with one pointing to 'https://seumenha.ru/award?keyword=autostoperski+vodic+kroz+galaksiju+pdf+download', suggesting a link farm or phishing attempt. The PDF structure and embedded links are indicative of an attempt to redirect users to malicious sites or download further payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/award?keyword=autostoperski+vodic+kroz+galaksiju+pdf+download
- https://cdn-cms.f-static.net/uploads/4417658/normal_6046e40657abb.pdf
- http://sollabs.xyz/476297336228dgw3.pdf
- https://cdn-cms.f-static.net/uploads/4377128/normal_60464efbaf0e2.pdf
- http://gerda-msk.ru/shark_rotator_professional_lift-away_upright_vacuum_reviewsek2f2.pdf
- http://creditinquiry.info/29393705337sl2nt.pdf
- https://cdn-cms.f-static.net/uploads/4485299/normal_60143de07f12f.pdf
- https://cdn-cms.f-static.net/uploads/4404313/normal_60277d9f3b699.pdf
- https://cdn-cms.f-static.net/uploads/4404503/normal_605949095948c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/31008995-0600-4edf-ac35-cfd383b547db/after_anna_todd_book_online.pdf
- https://uploads.strikinglycdn.com/files/cb360e24-3fcd-42a9-8a61-09d3f5b54437/bomavatibewibonunak.pdf
- https://uploads.strikinglycdn.com/files/27f0af07-937b-4745-bea6-6775e46491a4/rufunemiwewizon.pdf
- https://uploads.strikinglycdn.com/files/da1dab2b-654a-4f17-93fa-5ce3c62fbea4/obdlink_lx_iphone.pdf
- https://uploads.strikinglycdn.com/files/6a0daddc-cb49-4e57-8995-e70f68ad7b3e/9901069210.pdf
- https://uploads.strikinglycdn.com/files/d8c4ea04-94f2-4a51-affa-1d081c4a22a3/3875202282.pdf
- https://uploads.strikinglycdn.com/files/42c7505e-fa69-4fe5-ad67-a2c032c50464/barrons_ap_english_language_and_composition_flashcards.pdf
- https://uploads.strikinglycdn.com/files/a0ca75d6-82b9-41ca-9d1f-125bce323b62/cards_against_humanity_online_app_with_friends.pdf
- https://uploads.strikinglycdn.com/files/ec6d07a6-1893-4669-9676-7eb063ef797d/33820986297.pdf
- https://b3a1a1c9-4f8f-4fb8-b7cc-7339030cc889.filesusr.com/ugd/162fe6_c8b2a21f4a104562b545995e942e553a.pdf?index=true
- https://a3de454e-1598-42bb-a259-4eb69c42f179.filesusr.com/ugd/fb5067_38767687e031446d9553da5006062780.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1cb.bine41c80039fc4ee2b661c7da4fb686f3daa15c11f87693758b6dfcd2db84d45a7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1CB | 5656 bytes |
font_01_sfnt_off0001053e.bin9d294345ef77bfa7538916816fe8248c916c78a1be4b1ca4b857ccc4a1e40dda |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1053E | 11500 bytes |
font_02_sfnt_off00012bb7.bine9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12BB7 | 16092 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.