MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with a notable heuristic identifying it as a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to 'Bootstrap form maker online', aligning with the lure of a utility to attract clicks to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/123?utm_term=bootstrap+form+maker+online
- http://medgaj.com/migatak4z2x1.pdf
- http://big-ita.space/dazok1iyns.pdf
- https://cdn.sqhk.co/lenubire/78vhc6m/homeschooling_washington_state.pdf
- https://cdn-cms.f-static.net/uploads/4414336/normal_6026c1aa31bca.pdf
- http://ijmalan.xyz/jipunuvurejujawavusufec2mf.pdf
- http://good-production20.site/78711645186y2slr.pdf
- https://cdn.sqhk.co/sukurorezib/PhiKtQh/offline_gps_maps_windows_7.pdf
- https://cdn.sqhk.co/bovokolel/1nghDIe/tippy-_tip_corner_meaning.pdf
- https://cdn.sqhk.co/letareximo/gcshbIJ/10079392841.pdf
- http://italia-doc.space/628290278481ls35.pdf
- http://bitcoins-profits.com/kenmore_elite_he3_washer_replacement_parts6du6g.pdf
- http://dmgameplan.com/rita_mulcahy_pmp_exam_prep_10th_editionkw8sf.pdf
- https://cdn-cms.f-static.net/uploads/4449781/normal_605ac86a17ec9.pdf
- http://mir23.xyz/tissot_watches_t_touch_set_timeudxfa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_637693942e6a4dfabf5355065e98a1cf.pdf?index=true
- https://uploads.strikinglycdn.com/files/58632182-a5e0-482e-998a-830d336da705/username_privilege_secret_cisco.pdf
- https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_333c4fdfd449477b828128cd92d0a5d7.pdf?index=true
- https://uploads.strikinglycdn.com/files/b13bf003-0d5e-4146-89b6-a5e5798da744/html_css_interview_questions_and_answers_for_freshers.pdf
- https://86860ce8-2957-478e-97c3-2abddc2d2c3c.filesusr.com/ugd/754ed1_1a21b21f148944ecac0305b5fea8d50f.pdf?index=true
- https://uploads.strikinglycdn.com/files/5364a1fc-d8f4-4daf-bf63-4d896d6ca379/tadesajimasovobizida.pdf
- https://849bdae7-2456-4570-9e2a-fc769e7e49ad.filesusr.com/ugd/2074c9_acdbaf08ec924a9282b4a186a7588565.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef77.binb233179355aba76d86b09632cbd16af71fc70586c3da540751da7d5378433353 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF77 | 5160 bytes |
font_01_sfnt_off000100f4.bin059e1b26e696b5c674e5ed86d00bb71aeff025cae7c033ef980c5d6f04d8aee9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100F4 | 10712 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.