MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which point to a redirector URL (https://dugedepap.ru/strik?utm_term=la+grande+tribulation+dur%25C3%25A9e). This behavior is indicative of a link farm or phishing lure designed to drive traffic to malicious sites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=la+grande+tribulation+dur%25C3%25A9e PDF link annotation
- https://cdn-cms.f-static.net/uploads/4451021/normal_5fe91021ef8eb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369781/normal_5fd5f2e09390f.pdfIn PDF document text
- https://bunevozobete.weebly.com/uploads/1/3/4/7/134714888/079fd20de09.pdfIn PDF document text
- https://selokifasafu.weebly.com/uploads/1/3/4/3/134383977/5a635.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479240/normal_5ff4eb789fe83.pdfIn PDF document text
- https://janirakuvofubej.weebly.com/uploads/1/3/4/7/134734148/469424.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369506/normal_602c693ba6b2c.pdfIn PDF document text
- https://jodowofimen.weebly.com/uploads/1/3/5/3/135330599/d4a42a7242a14.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384483/normal_60117a22a2cbb.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bolovopizonuki/juwotujet.pdfIn PDF document text
- https://s3.amazonaws.com/zoluwivebiro/1001466849.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/78903f32-3a9e-4eb1-bc74-adf7e923e69c/babybjorn_baby_carrier_one_instructions.pdfIn PDF document text
- https://s3.amazonaws.com/lupebesu/pubepinuxizelexixijawewe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7de6992-6d67-486c-a4b7-9673b5b13a38/joy_luck_club_book_club_questions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/788acd3d-9c7c-4536-a83a-89a6adf9cdac/world_politics_trend_and_transformation_2020.pdfIn PDF document text
- https://s3.amazonaws.com/tetofamuxulil/85403867776.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8351b1ce-dd29-4089-ac8c-e8c0b876d49e/67968147218.pdfIn PDF document text
- https://s3.amazonaws.com/zikeko/chevy_colorado_diesel_performance_chip.pdfIn PDF document text
- https://s3.amazonaws.com/zalisujezajaje/the_hiding_place_betsie_quotes.pdfIn PDF document text
- https://s3.amazonaws.com/voxipanovigepiv/adosphere_1_answers.pdfIn PDF document text
- https://s3.amazonaws.com/jiwotarotavuz/haier_5000_btu_air_conditioner_walmart.pdfIn PDF document text
- https://s3.amazonaws.com/penale/sql_server_management_studio_old_version.pdfIn PDF document text
- https://s3.amazonaws.com/jolozidabi/sepogu.pdfIn PDF document text
- https://s3.amazonaws.com/wupiwupiwot/kikuvewinebakabadaxe.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e3da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3DA | 5036 bytes |
SHA-256: 1b6cff78dc136903b3304d959793dcdcc079594fe3b664b46fda1bc593f80ce7 |
|||
font_01_sfnt_off0000f4c6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4C6 | 10656 bytes |
SHA-256: f7862a16a01629f653c5310a1a705c1a47aaeb25337485bd9313c4658bd5509a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.