MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to psychology, suggesting a social engineering tactic.
Machine Learning
- Nyx PDF Classifier malicious score 0.9954
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/strik?utm_term=what+is+reinforcement+and+punishment+in+psychology PDF link annotation
- https://cdn.sqhk.co/pasepizut/f2zohb9/the_elder_scrolls_legends_dark_brotherhood_guide.pdfIn PDF document text
- http://nebofimanigi.sportsontheweb.net/manufactura_de_materiales_compuestos.pdfIn PDF document text
- http://debesur.iblogger.org/best_online_sat_practice.pdfIn PDF document text
- https://cdn.sqhk.co/gukisafuw/dgjIggd/pixel_shon_adventure_2018.pdfIn PDF document text
- https://cdn.sqhk.co/bavisimupux/ib5Z0je/lisesoxuwukonitetafoj.pdfIn PDF document text
- http://manamuposa.getenjoyment.net/jedi_i_trci.pdfIn PDF document text
- https://cdn.sqhk.co/mugodetutag/4nggA1a/probabili_formazioni_sportmediaset_1_giornata.pdfIn PDF document text
- https://cdn.sqhk.co/sileluzorupo/9leZXlz/49230346227.pdfIn PDF document text
- http://kovamuwaropepu.getenjoyment.net/16297035946.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/redegelesibif/biddeford_blankets_micro_plush_electric_heated_blanket_with_digital_controller.pdfIn PDF document text
- http://volenivojox.epizy.com/78349049289.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a3cc42d-f9c6-406a-b77c-78408b35efe3/93580023581.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aac34e0e-7fdd-4ecf-a1ce-613ed50ad123/81665407338.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/725924c4-8fa9-4fed-ab7f-860f147f7ef6/67795023229.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8fecb3e6-8f1b-4595-8b36-894f77b82909/three_stages_that_best_describe_the_progress_of_the_french_revolution.pdfIn PDF document text
- http://towawemigegi.epizy.com/lm35_temperature_sensor_data_sheet.pdfIn PDF document text
- http://tatuzukokamowa.rf.gd/statistical_analysis_of_financial_data.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d951cfdf-53fd-4dbf-8eb9-cf8473322a12/gimuxusinukesejojivej.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a41fc9cc-3e5b-4c4e-9e6f-ed7e0cd98042/viva_water_cooler_keeps_beeping.pdfIn PDF document text
- http://rabatelekovufar.myartsonline.com/sumekulebadiwo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aec78c11-cadf-473a-ba98-70c9f43c9d3f/nituvusuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce2a327e-de65-4d13-911e-b4625dd8cefd/suniriso.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/49d0a398-1928-47de-8aae-785da73e69de/61965079034.pdfIn PDF document text
- https://s3.amazonaws.com/zukogi/kipoxaxuf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/330a8a3c-20b8-4593-bc5e-8856694690d9/is_onyx_stone_valuable.pdfIn PDF document text
- https://s3.amazonaws.com/gezizefefififa/kezoka.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f61d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF61D | 5564 bytes |
SHA-256: d5308d9b5e8a619131adcf17d933b0de9d53804ddf31089ebe58c4a7b0e19dec |
|||
font_01_sfnt_off000108f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108F6 | 10528 bytes |
SHA-256: 93d9a3858e32ccf761dd41a4faacd24646791fa3744e5c18a478d2d091bd057c |
|||
font_02_sfnt_off00012cef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CEF | 4324 bytes |
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.