MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a heuristic indicating it is part of a link farm, with numerous external links. One prominent external URI, 'https://maypoin.ru/strik?utm_term=suma+y+resta+de+fracciones+heterogeneas+ejercicios+resueltos', is flagged as suspicious. ClamAV and ML classifiers also identified the file as malicious, specifically a phishing trojan. While no scripts were directly extracted, the PDF structure and external links suggest a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=suma+y+resta+de+fracciones+heterogeneas+ejercicios+resueltos PDF link annotation
- https://fizemovumevomuf.weebly.com/uploads/1/3/4/4/134491325/280a9459e.pdfIn PDF document text
- https://lobobofu.weebly.com/uploads/1/3/4/6/134680821/d7d07da6acc.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/1650be30-b366-4e87-9e3e-ea2cda40ba5d/como_saber_si_eres_un_lider_nato.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/068b8cf8-6479-4e8b-b614-79b3a1bb1481/24181549414.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b65ab4a-8b5e-473b-855f-6a7de8496d28/genie_intellicode_remote_reset.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/39227980-5948-42eb-9075-5fe8c14360cd/fisujisakopodolinorato.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e002f784-f7d2-48f6-806f-2b54ccdec96a/50631237559.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af513519-90fe-4507-b71c-3dd2096db3aa/best_american_short_stories_2019_toc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0786b461-fa06-4a6c-a268-6169e5b20722/d-link_dir-615_default_wireless_password.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0c904f19-1af6-4353-8dd7-b6a66bf0afd1/7522669893.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca66ee36-0ffe-4411-befb-cffc127f947d/percy_jackson_series_2_book_3.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b20b017d-e13c-4efb-8999-27ea856f4500/how_to_make_a_sticker_on_paint_3d.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5541a281-feee-449c-b5d3-a30bc2cf562c/dubagivosebud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0507d0cb-8e20-4f39-9286-f96bc134dbb1/wuxaduzeruzipexudeloga.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0dbbb950-8318-4cf6-946f-c6c56a7377a7/how_to_adjust_homelite_weed_eater_carburetor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e4ea7b72-2400-4af6-8990-3fec5d08c095/forunusifak.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5438145e-640d-4e55-b2cf-4f2c5f2d149e/2548257939.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e863b374-283a-4611-8a63-52d2e8d5faeb/how_to_prayer_for_a_child_with_mental_illness.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4ee4a58f-70e9-4a39-b7a6-43b13d811cf7/livro_propaganda_edward_bernays_portugues.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be6f54af-4f3f-436d-b2ec-3b2d2cbb49dd/free_westinghouse_sewing_machine_price.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb95.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB95 | 5716 bytes |
SHA-256: 42eb0c9236a6b3c7bb7306a109b7bc2a6172a4cdd4bc7cd41cae6e9ec2d752be |
|||
font_01_sfnt_off00010eea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EEA | 12440 bytes |
SHA-256: 9abe8ba31806384e5da1ed055eb16808788e14f6974d312c0f567f1092c8b0d1 |
|||
font_02_sfnt_off0001373e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1373E | 16088 bytes |
SHA-256: c487aa01613208473e3c0b892de3260687b9c0341624d6c76d95d7849508583e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.