MALICIOUS
236
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains multiple heuristics indicating malicious intent, including a link farm, a payment redirection lure, and ML classification flagging it as malicious. The embedded URL points to a site that is likely part of a phishing or scam operation. The presence of a password-protected archive lure suggests an attempt to bypass gateway scanning.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LUREDocument describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=is+creating+a+fortnite+account+free PDF link annotation
- http://keysecret.ru/zimadoziu2ji0.pdfIn PDF document text
- https://pelepidavivi.weebly.com/uploads/1/3/1/4/131454492/rifajuvezil.pdfIn PDF document text
- http://cosmosqrab.online/786365945051199p.pdfIn PDF document text
- https://nowiwadigomu.weebly.com/uploads/1/3/4/0/134018048/9241395.pdfIn PDF document text
- http://6gusevshop.space/piwowosevaulwrd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370269/normal_6010a8b6ca3f3.pdfIn PDF document text
- https://kinajerabisar.weebly.com/uploads/1/3/4/7/134748515/9421177.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408190/normal_60121f7831623.pdfIn PDF document text
- https://sisebafob.weebly.com/uploads/1/3/0/7/130776599/puxabik_netaravenomi_jejekel.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/69a93ba0-99d1-42b0-a85d-72d2ea552720/vipozovopijusoketu.pdfIn PDF document text
- https://s3.amazonaws.com/jeduzizonox/social_media_landscape_def.pdfIn PDF document text
- https://s3.amazonaws.com/sebunuzu/zemobibatole.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bba7d8ae-7983-4a52-94dc-457ee267b06d/how_to_explain_standardized_test_scores_to_parents.pdfIn PDF document text
- https://ba10d46a-d7c1-43af-8542-f1a50f31aa8a.filesusr.com/ugd/4dded2_1e1bcf522fcc4cb8ad2769e9524eed22.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xakusineba/8375840044.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b660fcb9-96de-42fe-9a4a-7c2cfc2973b2/how_to_install_sims_3_expansion_packs_steam.pdfIn PDF document text
- https://7fe6b731-3703-45da-bcbe-faf39b4d3392.filesusr.com/ugd/880a7e_eddce8622431481bb6042a23e4bbf7fa.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fedojigudaj/79421040728.pdfIn PDF document text
- https://d0fd22f1-78bd-4368-960d-2a324028b2bb.filesusr.com/ugd/a4d998_7f9a2726cc9842359320ae532b5a7bb3.pdf?index=trueIn PDF document text
- https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_56e63b63885e43efbaf9018fa61231ab.pdf?index=trueIn PDF document text
- https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_0fbc6580d4a24b78824ceff0f6b70b5e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/desekusoxi/tiganuregitifuzaxef.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/464a0e8a-6af1-4f20-bfeb-75d5daf61c89/mechanics_of_materials_3rd_edition_craig_solution_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fed6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFED6 | 4956 bytes |
SHA-256: 69419b0ec64ebdcf0c57797953cc3d99865b29fd25138ca39353f078986c8d84 |
|||
font_01_sfnt_off00010fc7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FC7 | 10672 bytes |
SHA-256: 9163bce0a18e0fd9a326d9886739a7c0836763fd1e4f66bc132cd2ec0fb6df58 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.