MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document is identified as malicious by multiple heuristics, including ClamAV and an ML classifier, and is structured as an image-only lure. It contains a mass of external links, with the primary suspicious URL being https://baarspo.ru/award?keyword=aritmatika+biner+pdf. The document's design suggests it is intended to trick users into clicking these links, likely leading to phishing pages or further malware downloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.8840
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 52 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/award?keyword=aritmatika+biner+pdf
- https://kizofirelurok.weebly.com/uploads/1/3/1/6/131606598/musikoziludexa_sukawataxej_selubirimo_mivaxoniwiloz.pdf
- http://trysalon.xyz/how_to_put_a_jawbone_jambox_in_pairing_modehtb3l.pdf
- https://furadigiwib.weebly.com/uploads/1/3/1/4/131407367/89818.pdf
- https://meripowubizaj.weebly.com/uploads/1/3/5/9/135959363/selutoru.pdf
- https://xizexinapak.weebly.com/uploads/1/3/4/3/134359948/087af89.pdf
- https://mekapejodefab.weebly.com/uploads/1/3/4/7/134740006/katuzozuvutip-tobedepaj.pdf
- http://pinerapidsrr.com/fabapenesozelexomojitkzsd.pdf
- https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_b4bac92b8fc54b989b893f55538317a0.pdf?index=true
- https://uploads.strikinglycdn.com/files/f6255cb0-168a-40a0-b79f-45d702b66876/mcdougal_littell_algebra_2_textbook_answers.pdf
- https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_72709a40f76648e4802c6666253ecf65.pdf?index=true
- https://s3.amazonaws.com/dewutexorob/55356355554.pdf
- https://s3.amazonaws.com/gajakelegeza/consonant_digraphs_th_worksheets.pdf
- https://s3.amazonaws.com/xonaxevetaf/26456689974.pdf
- https://s3.amazonaws.com/jarirotexab/gisexolibolojutibug.pdf
- https://eee7329a-c4d5-4508-a8fd-a8ba515f7d9f.filesusr.com/ugd/5ed802_20c1f5d9d64046d7bce857cffaa5db5a.pdf?index=true
- https://a49a6154-edc8-4132-95a2-c7bb8d673fe9.filesusr.com/ugd/551169_221a47eddeaf49e1a487eae917cee768.pdf?index=true
- https://uploads.strikinglycdn.com/files/842d6dbc-dfce-4c00-8be7-af4e7ac1a138/demoneduleweba.pdf
- https://012a8781-80b6-4d33-8f63-56d56ef93f15.filesusr.com/ugd/6d3794_5593f247840b49d7bd1308c459b423c8.pdf?index=true
- https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_6c040325b9ee40fb9e150536fcaca508.pdf?index=true
- https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_c46ae759ec994642b36abbe0869365e7.pdf?index=true
- https://8f1ef4f7-3f23-41ef-a3d6-4e5873a175a2.filesusr.com/ugd/d318ce_96abffece914426b8310212f593addac.pdf?index=true
- https://441768bb-9839-4df4-8f78-dd1233b527f6.filesusr.com/ugd/7e6080_63e060668e374bc798daba48c290f6ea.pdf?index=true
- https://87098103-4d08-48bb-90a6-807b0ef734b2.filesusr.com/ugd/1f49de_577268ef07a448d69b86cfd2dfe499b7.pdf?index=true
Open this report in the interactive analyzer, or submit your own file for analysis.