MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple external URIs, with the primary one being a link to 'pelibifir.ru'. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, suggests a lure related to 'postpartum hemorrhage acog 2020 pdf', likely to trick users into clicking the embedded links. The presence of numerous disposable and linked domains further supports a phishing or scam campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/award?keyword=postpartum+hemorrhage+acog+2020+pdf PDF link annotation
- https://cdn.sqhk.co/jukowejazus/X4gfOhV/neon_hockey_2_player.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4423471/normal_5feba40ce4a96.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378855/normal_5ff6b46c67398.pdfIn PDF document text
- http://pinopizo.sportsontheweb.net/33119015103.pdfIn PDF document text
- http://rakadan.sportsontheweb.net/nordictrack_commercial_1750_assembly_cost.pdfIn PDF document text
- http://gejokakop.mygamesonline.org/fodapejojezawawudo.pdfIn PDF document text
- http://fisareboveda.getenjoyment.net/maths_workbook_for_class_6.pdfIn PDF document text
- http://reactivaperu-viabcpi.com/dibuduwapudifizamesikepu4psmz.pdfIn PDF document text
- http://wozilimesiz.mypressonline.com/mariage_d_amour_piano_easy.pdfIn PDF document text
- https://cdn.sqhk.co/dinokafoxume/he7ibgd/free_printable_fax_cover_sheet_without_ing.pdfIn PDF document text
- http://fafesixokegigi.getenjoyment.net/categories_of_artificial_intelligence.pdfIn PDF document text
- http://gepanukotex.getenjoyment.net/2011_rav4_sport_for_sale.pdfIn PDF document text
- http://lejifip.sportsontheweb.net/33380647259.pdfIn PDF document text
- https://cdn.sqhk.co/dekavaka/ggjdhif/flexeril_pill_picture.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389616/normal_60307d59e4b4f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4480170/normal_5fccc2f22a4b5.pdfIn PDF document text
- http://50offstore.pro/optimate_4_bmw_canbusffk4u.pdfIn PDF document text
- https://cdn.sqhk.co/tisufupujeli/gW3ifje/livavuwelugenakajafix.pdfIn PDF document text
- https://cdn.sqhk.co/bupitagalir/FYgjvic/hootsuite_amplify_cost.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://d99c26cc-8c68-456d-a039-1a26994c8d26.filesusr.com/ugd/105a8c_e89853d706ad444aa1c4dc86214b7ea6.pdf?index=trueIn PDF document text
- https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_db9ccd129dcd42c88bb1894c5c159a0b.pdf?index=trueIn PDF document text
- https://2a1457bb-a4d2-449b-8914-d784a503a6da.filesusr.com/ugd/c0fca2_0c2f936419a54bc88a82ed93cc7b4612.pdf?index=trueIn PDF document text
- https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_f38fe70caa784f9c82cc2bad26e4d62b.pdf?index=trueIn PDF document text
- https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_c9a6ed93eede49cdbc1ae178ab7c75e4.pdf?index=trueIn PDF document text
- http://dolanuvusipegu.myartsonline.com/lelewosurumoriwewe.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f40b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF40B | 5812 bytes |
SHA-256: b426a415379a3f1af084b80c894d571995b9635404aecddd36e80c5300404359 |
|||
font_01_sfnt_off000107b3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107B3 | 10688 bytes |
SHA-256: f581ac9115a406400e25aec80671f86b839635e379b0ce6f0834879b95f23649 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.