MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF sample was flagged by multiple heuristics, including a high-confidence ML classifier and ClamAV detection as a phishing trojan. The document contains numerous embedded URLs pointing to various domains, suggesting a link farm designed to redirect users. The presence of 'utm_term=magic+call+unlimited+credits+mod+apk+download' in one URL indicates a potential lure for pirated software or scams.
Machine Learning
- Nyx PDF Classifier malicious score 0.8259
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://optical-axis.com/uploads/files/202109100743579979.pdf In PDF document text
- https://loonbedrijfschimmel.nl/userfiles/files/34626152384.pdfIn PDF document text
- http://cerezolorente.com/files/cerezolorente/_repo/file/25478372203.pdfIn PDF document text
- http://www.salpasafarit.fi/tiedostot/files/pijonuni.pdfIn PDF document text
- http://yeongwonenc.com/userfiles/file/mubivumosagi.pdfIn PDF document text
- http://keitbg.com/images/files/lukefala.pdfIn PDF document text
- http://evolutionchonburi.com/userfiles/files/gurawo.pdfIn PDF document text
- https://www.tocbirsen.org.tr/ckfinder/userfiles/files/49320629446.pdfIn PDF document text
- http://studiovalecchi.it/userfiles/files/69008118097.pdfIn PDF document text
- https://at1apigroup3.com/contents/files/fizabowas.pdfIn PDF document text
- https://www.tratedu.net/ssss2018/assets/143ad273/ckfinder/core/connector/php/upload/userfiles/files/8d5836b1de3d5ea2fffee72f9fd0aa7a.pdfIn PDF document text
- http://vodova51-53.cz/files/17188848456.pdfIn PDF document text
- https://jackyrouxmethode.com/userfiles/file/lajurelazagevunepov.pdfIn PDF document text
- https://viettincapital.vn/upload/files/fafevuzofutewofafun.pdfIn PDF document text
- http://huabulaw.com/uploadpic/2021-9/file/2021091815481173499.pdfIn PDF document text
- http://sbs-group.co/userfiles/files/tugubedapojibo.pdfIn PDF document text
- https://e-ceramika.pl/userfiles/file/wilitafamubanudusopaluf.pdfIn PDF document text
- https://kalitelivideoizle.com/resimler/files/1180905682.pdfIn PDF document text
- http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/1613681ebca514---gafapujokawavarefepemomip.pdfIn PDF document text
- https://h16hr15k-h19hr37urn.com/contents/files/vubonederowevabijebiri.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=magic+call+unlimited+credits+mod+apk+downloadPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b8f3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB8F3 | 17008 bytes |
SHA-256: e149c0863845dbcf8b403c08b983bf3f32c075da2bde98aacc36565204c18dcb |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.