MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.5434
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.veedik.net/assets/admin/kcfinder/upload/files/xejulowodukiduz.pdf In PDF document text
- https://nutritie-metabolism-sanatate.ro/app/webroot/files/userfiles/files/dokolisu.pdfIn PDF document text
- http://theonejsc.com/userfiles/file/tegofowaruzefipetezowabux.pdfIn PDF document text
- http://aven.su/kcfinder/upload/files/xiponodivudo.pdfIn PDF document text
- http://kawarulabo.com/app/webroot/js/kcfinder/upload/files/65407456829.pdfIn PDF document text
- https://sayapdewa.com/contents/files/binurupigusevi.pdfIn PDF document text
- https://www.marmaclbd.com/assets/ckeditor/kcfinder/upload/files/34281326669.pdfIn PDF document text
- http://thietbiantoanttk.com/uploads/files/24490152775.pdfIn PDF document text
- http://www.cpl.odrolnika.pl/kcfinder/upload/files/kopedozotozasesuwure.pdfIn PDF document text
- https://vinamex.info/uploads/news_file/64666829603.pdfIn PDF document text
- https://highrise.pl/file/polibulovixetibujawajedug.pdfIn PDF document text
- https://kermoulin.com/userfiles/file/67095396045.pdfIn PDF document text
- https://www.reptrics.com/kcfinder/upload/files/gegeda.pdfIn PDF document text
- https://kimtuong.vn/isc/public/files/fckupload/file/75556503173.pdfIn PDF document text
- http://www.icmtravel.net/assets/ckeditor/kcfinder/upload/files/46453362020.pdfIn PDF document text
- http://tgtech-auto.com/userfiles/file/zagevasimekinulas.pdfIn PDF document text
- http://valk.dn.ua/js/kcfinder/upload/files/luwofovefubapewupo.pdfIn PDF document text
- http://ilovestory.com/upload/file/tugexuvek.pdfIn PDF document text
- https://metrosecuritynepal.com/assets/userfiles/files/61180273493.pdfIn PDF document text
- http://carrozzeriardue.it/userfiles/files/67413613949.pdfIn PDF document text
- https://gornjastubica.hr/files/vibize.pdfIn PDF document text
- https://agt.twwebmarket.com/ckfinder/userfiles/files/94724863185.pdfIn PDF document text
- http://konstruktor33.ru/app/webroot/files/files/regafusakinovuparimonagel.pdfIn PDF document text
- http://ccemax.com/js/kcfinder/upload/files/24567113826.pdfIn PDF document text
- http://mos-craciun-inchiriere.ro/fckfiles/file/raxesisevanufem.pdfIn PDF document text
- http://jiuxingchaoshi.com/uploads/file/121652237813.pdfIn PDF document text
- http://vhshf.de/File/zupokek.pdfIn PDF document text
- http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621999c7cc1a4---53373733649.pdfIn PDF document text
- https://alummaswaja.com/yii/sdbalikpapan/home/images/upload/files/gojagotogorogezofez.pdfIn PDF document text
- https://grupahatak.pl/admin/_fck_files/file/62513652571.pdfIn PDF document text
- https://dpengineerindia.com/admin/userfiles/file/vikenaluxajimovukobog.pdfIn PDF document text
- http://xn--80aamwn.xn--p1ai/userfiles/file/61874920002.pdfIn PDF document text
- http://ventexevent.se/uploads/file/giwomiliba.pdfIn PDF document text
- http://lechioutdoor.com/userfiles/file/6809223940.pdfIn PDF document text
- http://csc-028.com/userfiles/file/20220214024625_a4vpou.pdfIn PDF document text
- https://argumentua.com/i/file/juxopuxexekurepovaf.pdfIn PDF document text
- http://patroha.hu/file/puxikenebekadomakurona.pdfIn PDF document text
- http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/4mplsgmesh03m71l14ovbf5itk/50311295177.pdfIn PDF document text
- http://wxbeimei.cn/upload/ckimg/files/202202111403431512.pdfIn PDF document text
- http://www.civilhospitalpalampur.in/img/uploads/files/vixuwetefigutajuw.pdfIn PDF document text
- http://bezpiecznamlodosc.org/files/file/robokonimida.pdfIn PDF document text
- https://www.nutfruit.org/js/admin/ckeditor/plugins/kcfinder/upload/files/89325230773.pdfIn PDF document text
- http://alt-1c.ru/userfiles/file/najudozikibupumek.pdfIn PDF document text
- http://xn----8sbemnkjd7bfu.xn--p1ai/design/img/upload/file/bepuxudefuko.pdfIn PDF document text
- https://helices-evra.com/userfiles/file/15815877223.pdfIn PDF document text
- https://www.yamamotonouen.jp/js/kcfinder/upload/files/86863892071.pdfIn PDF document text
- http://www.sbawerribee.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1622895629e698---kaxeduvofajitadoped.pdfIn PDF document text
- https://ragaz.co.za/XSRYdR1H?utm_term=fire+emblem+awakening+second+sealPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
+6 more URL(s)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004f004.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4F004 | 10912 bytes |
SHA-256: 88ebce1830e62b5d80185cbcde0be37e5da72a3854930bd381ddf9d6aed9e62f |
|||
font_01_sfnt_off00050914.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x50914 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off00052031.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x52031 | 2244 bytes |
SHA-256: 8e10b892c36fa8ad987842b29a2443fe241431fa55a64827d40d9584f23ba5cb |
|||
font_03_sfnt_off00052a4a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x52A4A | 21248 bytes |
SHA-256: f30088615943388db6aab9976733d9b67409f2afa92b3a71fc5790399f9d6722 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.