MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URL pointing to a website that promises free gift cards, a common lure for phishing and scam operations. Heuristics indicate the PDF is a link farm hosted on disposable domains, further supporting a malicious intent. ClamAV detection and ML classification confirm the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/wix?keyword=robux.free+gift+card.org PDF link annotation
- https://cdn.sqhk.co/lofakekaf/eggTTjd/lilapovuzusotabenutodakor.pdfIn PDF document text
- http://towuzura.22web.org/dazemakezojaja.pdfIn PDF document text
- https://cdn.sqhk.co/lewiwifo/ihaRifw/usa_network_shows_90s.pdfIn PDF document text
- https://cdn.sqhk.co/ponajadu/gsl1yB5/5516084987.pdfIn PDF document text
- https://cdn.sqhk.co/ditutafewaw/aKhgcjg/ambulance_siren_sounds_in_words.pdfIn PDF document text
- https://cdn.sqhk.co/rijolumexeb/jbLbjiS/21101430463.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://nunoxemimo.rf.gd/chemistry_lab_manual_for_class_10_cbse.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ecd0321c-6271-4074-bea4-a1e4fdde6022/how_do_you_reset_a_nuvision_tablet.pdfIn PDF document text
- https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_ba148260fbfa44f799ae14550289b49a.pdf?index=trueIn PDF document text
- https://ba85394b-11ac-4ca4-926b-74ca936c52e1.filesusr.com/ugd/5ccfc8_88aa057faaa84c9aa8304632d9f0fa89.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/693ac5d6-4426-4a02-a86d-dfc339ed3272/monster_vs_aliens_voice_actors.pdfIn PDF document text
- https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_2225231e06a64a6ba4fe754d7d37458a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/318d3010-137d-4cb0-9e93-bd9d4bffd3dc/exercise_on_verbs_for_class_4.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1bdb5fd3-b151-462a-b5e9-4b448cbbb05d/68526604820.pdfIn PDF document text
- https://0e733887-fd72-4d21-8b10-0a39cafbc931.filesusr.com/ugd/1e4d10_c2459eef9027499f88b00e0ba7c56c9a.pdf?index=trueIn PDF document text
- https://8bd0dbf5-62e0-4684-a95a-1d9666dfa34a.filesusr.com/ugd/e71694_2d2916416c034a1db4b734ed86f0d4db.pdf?index=trueIn PDF document text
- http://napezidemilolez.epizy.com/android_phone_software_update_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cacd8012-5139-4738-bd48-27006563696b/tobopiganugusifu.pdfIn PDF document text
- http://wivirimudip.epizy.com/citizen_at9010-52e_eco-drive_silvertone.pdfIn PDF document text
- http://rikopob.epizy.com/how_to_set_time_on_casio_wave_ceptor_5161.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off00011d3b.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11D3B | 18536 bytes |
SHA-256: 0add70b094fbcd235666d27b452044e81f6e29a8bc10f1fffd8c74d529a81630 |
|||
font_00_sfnt_off0000e68c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE68C | 5000 bytes |
SHA-256: 06fefecea26a21b062ccac0b546d77489c1be832fcea3f474a0f3b6b173f134f |
|||
font_01_sfnt_off0000f7b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7B5 | 10892 bytes |
SHA-256: e2f02262af18c24415d66e5f6f22a3badf4493506e963dad5a8a7e17c825e53d |
|||
font_03_sfnt_off000139df.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x139DF | 4324 bytes |
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.