MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain, likely intended to trick the user into downloading a password-protected archive. The document's structure and embedded links suggest a phishing attempt to deliver a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/aws?utm_term=how+do+i+reset+my+homepod+to+factory+settings PDF link annotation
- http://ziratonis.iblogger.org/79729022125.pdfIn PDF document text
- https://bepopasexib.weebly.com/uploads/1/3/4/3/134356469/5350763.pdfIn PDF document text
- https://cdn.sqhk.co/rufebumu/ijijhgq/79943713550.pdfIn PDF document text
- https://cdn.sqhk.co/parikozug/Ehdiazu/bedoyecta_b12_para_que_sirve.pdfIn PDF document text
- https://cdn.sqhk.co/posojuvapono/8hhyo8e/guruloxusozirovas.pdfIn PDF document text
- http://tedabelefodeb.22web.org/how_to_decorate_the_tree_house_in_adopt_me.pdfIn PDF document text
- https://libexezelidod.weebly.com/uploads/1/3/1/4/131454359/28102b3.pdfIn PDF document text
- https://cdn.sqhk.co/moviferu/jihg12T/mirrorless_camera_black_friday_2018.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4493209/normal_60149f2f6feae.pdfIn PDF document text
- http://xutuvulamarav.iblogger.org/what_caused_brown_vs_board_of_education.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482399/normal_5ffd4a5a68d0a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://234a0c07-d908-4261-bb83-16b3c96a9b04.filesusr.com/ugd/73e0e6_e20c77df855a413fa6f5102a340181bd.pdf?index=trueIn PDF document text
- https://1639490a-f715-481e-9fb1-af38d332269b.filesusr.com/ugd/a59130_2a6a5bcb76b5447b87bbce2cf8434f35.pdf?index=trueIn PDF document text
- https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_e676b948fa4247ef88d7ead4240ea859.pdf?index=trueIn PDF document text
- https://73856814-13bb-4d44-aeaf-752cce6ba6bd.filesusr.com/ugd/a0d21a_de1bc045dd564ec4aefc887da60cb650.pdf?index=trueIn PDF document text
- https://c3e780e1-a1ee-422e-80b3-2bf79490ff1e.filesusr.com/ugd/dc7b26_d04aa71e2fe743d8b123770c3b26ae66.pdf?index=trueIn PDF document text
- https://4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com/ugd/54fa57_cf34e4fe4a724a509467ed08d7783649.pdf?index=trueIn PDF document text
- http://rolivobo.epizy.com/converter_to_word_file.pdfIn PDF document text
- http://loxosufodu.epizy.com/76795428562.pdfIn PDF document text
- https://11f44e1d-c86f-4be6-baa1-90970e7c24f5.filesusr.com/ugd/a298ce_578b799ada30419a9d722425790343a5.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f355.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF355 | 5692 bytes |
SHA-256: 93a2ed9bc8179d9919b0c92091807ffbae7837693a4b70a3cc02885b1920161f |
|||
font_01_sfnt_off0001069f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1069F | 10532 bytes |
SHA-256: 935997f72c0d7b9ea7a0ef1fbc05a9964b406b3859bc4f55e4a81da5e9de6e2e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.