MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains heuristics indicating it is a link farm and a phishing lure, specifically mentioning an invoice or payment context. It embeds multiple external URIs, with a primary suspicious URL being https://bologen.ru/123?utm_term=thl+credit+senior+loan+fund+annual+report. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for downloading a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/123?utm_term=thl+credit+senior+loan+fund+annual+report PDF link annotation
- http://sudilufib.getenjoyment.net/najogebijogafifi.pdfIn PDF document text
- http://tixshopclub.fun/gafapaf6awhh.pdfIn PDF document text
- http://milansit.space/gitevkoaym.pdfIn PDF document text
- http://antonioit.fun/74726223437p1jz6.pdfIn PDF document text
- http://jetinaxisodew.mypressonline.com/36788221756.pdfIn PDF document text
- http://sweetygirl.club/invasive_species_worksheet_elementarykwui1.pdfIn PDF document text
- http://sport-stavki.fun/cuisinart_compact_juice_extractor_je-1000pczwoo8.pdfIn PDF document text
- http://jukomanafow.22web.org/garmin_gpsmap_7612_user_manual.pdfIn PDF document text
- http://santaparker.store/canon_powershot_sx510_hs_wifi_setup73jkn.pdfIn PDF document text
- http://detonic-buy.website/book_of_shadows_5e3qnnd.pdfIn PDF document text
- http://ru-order-687646765445.art/acer_chromebook_15_cb515-1ht_review30ohd.pdfIn PDF document text
- http://sewaseg.22web.org/dell_vostro_1500_ram_specs.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/437214b5-56ec-4782-ae7c-29031b1ca342/kenebizuxezijatozavobene.pdfIn PDF document text
- http://lijobexabip.rf.gd/13795798371.pdfIn PDF document text
- http://misugivunuzu.epizy.com/53134514376.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe3376f5-2cb4-4e15-a30a-b04df66ed38a/cisco_dpc3008_reset.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0fef7912-a3ac-4813-8e27-932832055835/how_to_improve_teamwork_and_communication_in_healthcare.pdfIn PDF document text
- http://vovojoj.atwebpages.com/75292508721.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0de1d7cf-466d-4e47-8765-bba136187abf/m-audio_keystation_49_mk3_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b485205-6a97-4e85-9c73-4346c0c842a1/duxam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9abe85c2-62e8-4f2f-87ad-5dcf4c433e43/best_short_stories_in_english_by_indian_authors.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25694ef8-ca69-4ce1-9505-0f59425b6c5e/what_are_dunkin_donuts_coffee_sizes.pdfIn PDF document text
- http://fosadexovoz.epizy.com/is_stock_market_open_mlk_day_2020.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f382.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF382 | 5192 bytes |
SHA-256: dc19e907c1dd8b668b6f3b784d73061688ca33c4f13e8d64db2b00538ce60e90 |
|||
font_01_sfnt_off00010524.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10524 | 10672 bytes |
SHA-256: 482b511591db577cb2e315916a724425af1c9d7ded04fe83de58300e02b474ce |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.