MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm or redirection scheme to deliver malicious content. The presence of 'utm_term' parameters in some URLs indicates tracking or campaign-specific lures.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/123?utm_term=chakram+south+movie PDF link annotation
- https://cdn.sqhk.co/molipigi/iighfF2/solar_system_diagram_with_asteroid_belt.pdfIn PDF document text
- http://itawomen.fun/5786832980297fs8.pdfIn PDF document text
- https://cdn.sqhk.co/toromerepowa/hgBFhcs/sirelubuj.pdfIn PDF document text
- http://idealica-italy.site/would_you_rather_questions_clean_buzzfeedon80i.pdfIn PDF document text
- https://cdn.sqhk.co/tinipuded/aghjhij/colors_of_the_wind_sheet_music_piano.pdfIn PDF document text
- https://cdn.sqhk.co/sitopizol/gfhgQ7G/at_t_office_hand_support.pdfIn PDF document text
- http://lastasked.com/modelos_del_crecimiento_humanoodb22.pdfIn PDF document text
- http://wibimozuj.22web.org/search_google_or_type_a_url_meme.pdfIn PDF document text
- http://prizinsta.online/413337997631ndl9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5b144434-b018-4a80-aa65-0ed2d8a59c44/xiluguxinud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b35de18e-d607-49c0-8e68-f23c2718196c/what_does_error_e03_mean_on_a_washing_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bcf457b7-8648-4e78-808b-d73acee77065/jamaican_dancehall_music_videos_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31f791e3-90fe-4180-b14b-0fed3e8a7e23/tikosejidusebifamex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46bdca7b-c9c4-4972-9ae7-16ec48db7428/charter_remote_setup_without_code.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8502fea5-4476-4061-be49-8311a4d17038/are_fan_heaters_good.pdfIn PDF document text
- https://s3.amazonaws.com/siwixomudit/zonerakexubum.pdfIn PDF document text
- https://s3.amazonaws.com/muvemasoxaji/natokizakadowib.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/70d2ad40-a124-434f-88a2-e5c1c8a5015a/watch_the_alchemist_movie_paulo_coelho.pdfIn PDF document text
- https://s3.amazonaws.com/jovekus/finawupemo.pdfIn PDF document text
- https://s3.amazonaws.com/mukutud/914933847.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9437e44a-4a35-46d4-b3e4-576c214e400b/how_to_get_a_motorcycle_learners_permit_in_ny.pdfIn PDF document text
- http://pepebejawu.epizy.com/35227328453.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99f6f892-d0e5-4522-9bd3-4064dba7a31f/msi_760gm-e51_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/153ecbff-ebbc-4cec-8cef-35871fa5e3c1/why_wont_my_fellowes_shredder_turn_on.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dbf4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDBF4 | 4924 bytes |
SHA-256: d42192c7051f1900d7cda3fc4d3fa792a8d6dced3bd5c1f50503207e9a80cc1d |
|||
font_01_sfnt_off0000ec86.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC86 | 10712 bytes |
SHA-256: 41b852cbb74f590cf902f4edb277c21c9310af1b0c2dbc23b347027a99e30dd6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.