MALICIOUS
106
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.2064
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ragaz.co.za/XSRYdR1H?utm_term=transformers+prime+arcee+x+jack PDF link annotation
- http://steinkirchener-bauernschaenke.de/img/editor/file/48403920491.pdfIn PDF document text
- https://adamant54.ru/userfiles/files/35411923222.pdfIn PDF document text
- http://eskuvoiiranytu.hu/blog/file/32758391162.pdfIn PDF document text
- http://erictex.com/ufiles/files/52748162108.pdfIn PDF document text
- http://bettaletroom.com/file_media/file_image/file/68420297707.pdfIn PDF document text
- https://cosanuesa.com/componentes/editor/ckfinder/userfiles/files/14317136844.pdfIn PDF document text
- http://burmeseburmilla-allevamento.com/userfiles/files/7406959905.pdfIn PDF document text
- http://michalpavlicek.com/uploaded/file/70658557842.pdfIn PDF document text
- https://permargi.com/files/galeria/files/23488935975.pdfIn PDF document text
- http://skolka.pencin.cz/soubory/file/38999046638.pdfIn PDF document text
- http://www.guard.ee/kcfinder/upload/files/39316241144.pdfIn PDF document text
- http://aid-calais.com/userfiles/file/supimufifelixupujigazun.pdfIn PDF document text
- https://ntiverification.com/userfiles/file/87922347284.pdfIn PDF document text
- http://pp-aqua.com/userfiles/files/lijenududujisokivo.pdfIn PDF document text
- https://phucatgarment.com.vn/ckfinder/userfiles/files/41525699351.pdfIn PDF document text
- http://jagdrevier.hu/upload/images/file/44208557826.pdfIn PDF document text
- https://manorhair.com/uploads/files/202111120659572413.pdfIn PDF document text
- http://xn--elementy-zczne-kwb98g.pl/media/file/movalazupixolesivaf.pdfIn PDF document text
- http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/161daa2d2729b5---58503363790.pdfIn PDF document text
- https://stepweystudy.com/ckfinder/userfiles/files/zizifejidakuj.pdfIn PDF document text
- http://adamlegal.com/userfiles/file/600238792.pdfIn PDF document text
- http://twtqedu.com/userData/ebizro_board/file/kikenupera.pdfIn PDF document text
- http://dianacb.cz/userfiles/file/kanapukogotupo.pdfIn PDF document text
- https://hurghadalife.net/userfiles/files/47217010956.pdfIn PDF document text
- https://riverasphotovideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/161bb0912032f9---masulevakejenunopoje.pdfIn PDF document text
- http://papinchess.ru/userfiles/file/ligot.pdfIn PDF document text
- http://cayxaotamphan.net/userfiles/image/file/30371109150.pdfIn PDF document text
- http://todaystravel.com.tn/kcfinder/upload/files/75068211523.pdfIn PDF document text
- https://evergreencans.com/userfiles/file/fipefameporitawewirarafip.pdfIn PDF document text
- https://pmeds.us/userfiles/file/75435443110.pdfIn PDF document text
- https://masihpt1.com/contents//files/wewitikibo.pdfIn PDF document text
- http://www.annaleehuber.com/content_files/file/wanoxoze.pdfIn PDF document text
- http://uralcomservis.ru/crn_fls/crn_files/nasatilobumepe.pdfIn PDF document text
- http://doktor-okonski.pl/uploadimg/file/kitovenerikurijajexo.pdfIn PDF document text
- https://royal-art.pl/uploads/userfiles/files/75914407142.pdfIn PDF document text
- https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/9gukbu6713omfl0b0271h8pmgd/88913773025.pdfIn PDF document text
- https://ever-progress.dacola.com/upload/files/litowejinakipuma.pdfIn PDF document text
- http://jolanyee.com/upload/files/202112101205584895.pdfIn PDF document text
- http://askaudit.ru/price/jeninavadosig.pdfIn PDF document text
- http://ark-mr.com/data/home/qxu2063190031/htdocs/uploadfile/files/malipametufezefudu.pdfIn PDF document text
- https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/9f47d4f0e936205346c0225762d5fdee/45789166422.pdfIn PDF document text
- http://newshop.jp/archive/file/xagetozemava.pdfIn PDF document text
- http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160e61a73ede6e---wuxukunikalizopizosa.pdfIn PDF document text
- http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/ekf24udsuusfsonki6rau6t8m2/20634505700.pdfIn PDF document text
- http://probeg2000.ru/files/userfiles/files/81887896699.pdfIn PDF document text
- http://thegroverestaurantnj.com/userfiles/files/jebipakogosebezakole.pdfIn PDF document text
- http://thrifty-uy.com/files/others/25415739414.pdfIn PDF document text
- https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/161bbaa2bbbeeb---92792617414.pdfIn PDF document text
- http://ranahytta.com/ckfinder/userfiles/files/roloxozuzisosa.pdfIn PDF document text
+8 more URL(s)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0006fd54.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6FD54 | 17420 bytes |
SHA-256: f46536574c466f68f164f66cc07874bd5a5e717dbc8fe5065aa84b5e8d685ea0 |
|||
font_01_sfnt_off00072ac2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x72AC2 | 10784 bytes |
SHA-256: 05190e05d3e4687bfdc55734ea6994c6c79f53372cfc9fab06086284fc66f72f |
|||
font_02_sfnt_off00074391.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x74391 | 12176 bytes |
SHA-256: 4b14ef8bbd11bd8e92abe5c999a10fc15732d825d288635e06618faa32812010 |
|||
font_03_sfnt_off000769f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x769F6 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.