MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, specifically as a phishing trojan. It contains numerous external URIs, with the primary one being `https://maypoin.ru/strik?utm_term=batman+death+in+the+family+interactive+movie+trailer`, suggesting a lure to a malicious site. The document body is heavily obfuscated and appears to contain metadata rather than user-readable content, indicating the primary malicious function is likely executed via embedded links or scripts, though no scripts were explicitly extracted.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=batman+death+in+the+family+interactive+movie+trailer PDF link annotation
- https://cdn.sqhk.co/remezebona/bgjib6v/6194126746.pdfIn PDF document text
- https://cdn.sqhk.co/sewenajete/bChj1ig/63774330723.pdfIn PDF document text
- https://cdn.sqhk.co/genizataxom/iadhdjc/78315288011.pdfIn PDF document text
- http://kojazunupetip.mygamesonline.org/mefenuxi.pdfIn PDF document text
- https://cdn.sqhk.co/gulidepiz/bgczAau/zesukegedukibavus.pdfIn PDF document text
- https://cdn.sqhk.co/nobegasosev/dROu32a/blackjack_21_endless_free_download_for_pc.pdfIn PDF document text
- http://zeboxagekej.sportsontheweb.net/dinilitibakudane.pdfIn PDF document text
- http://numulul.mygamesonline.org/training_the_best_dog_ever.pdfIn PDF document text
- http://wiwajekirutiw.scienceontheweb.net/32992737446.pdfIn PDF document text
- http://jufanurozud.getenjoyment.net/faxedutakemeperadesud.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a0d546f6-6a3f-4125-9f8e-c92fa2f9be5d/22066522797.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4bd89367-374f-4458-ab5f-577fda7353d1/93061891084.pdfIn PDF document text
- https://s3.amazonaws.com/napisakaluja/report_on_sports_day_celebration_in_college.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/714a5766-0e34-48b6-af08-01b95811228c/kosozovetomagetegeluj.pdfIn PDF document text
- http://tidalar.rf.gd/buvanutuzaza.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d04ed8b5-3302-4be3-83f6-41103780edb4/defining_black_feminist_thought_patricia_hill_collins.pdfIn PDF document text
- http://baxudoxubalafe.epizy.com/cetuximab_acneiform_rash_management.pdfIn PDF document text
- http://bikufupok.rf.gd/create_email_marketing_template_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e92cf0e-bba9-4267-83a5-ec7546f627b8/biwir.pdfIn PDF document text
- https://s3.amazonaws.com/bejexe/contemplate_tagalog_dictionary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c9cc1dbb-4fb5-4923-a1bf-dc8189742ba0/nordictrack_audiostrider_990_pro_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa6cdd90-76c0-4f87-a464-b884141c22d2/pokonitazi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b09fd481-fc6b-4b95-94f7-312e4e0a24d9/muredalerufit.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000108f5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108F5 | 5296 bytes |
SHA-256: e1f5145bd487e4b97ed5d41debf5d1a5f5d3387d400c6ee26e148e86808ad8fc |
|||
font_01_sfnt_off00011ade.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11ADE | 11496 bytes |
SHA-256: b71a1aa410862eba9a188c9e30e898d7d1fbccbcf443d55343b4c944ff09c601 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.