MALICIOUS
236
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. The heuristics indicate it contains a large number of external links, potentially for SEO manipulation or to host further malicious content. Crucially, it includes a lure to copy/paste content into a command execution context and instructions for handling password-protected archives, suggesting a multi-stage attack. The embedded URL `https://pelibifir.ru/strik?utm_term=d-link+dns-321+password+reset` is a primary indicator of the phishing or scam attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=d-link+dns-321+password+reset
- https://mejebepagomuda.weebly.com/uploads/1/3/4/4/134494428/retijiwepigonamojaz.pdf
- http://blockhcain.host/macbook_pro_autocad_performance3sn1c.pdf
- https://doxagazezuzizum.weebly.com/uploads/1/3/1/6/131606815/zezabivezapir.pdf
- http://gonzo-3d.com/cafe_brunelli_menullzkn.pdf
- http://mavitrade.com/ginafalufanifab397y5.pdf
- https://pozesipo.weebly.com/uploads/1/3/5/3/135346015/wipevur-bulezazuvafus-fuzan-paxipewinuxe.pdf
- https://gosedizomomusuw.weebly.com/uploads/1/3/4/3/134313056/4db7574ca8c.pdf
- http://copyrightsafetyhelps.com/arrl_handbook_1990_free_downloadvt9hr.pdf
- https://jibabarudemafe.weebly.com/uploads/1/3/4/7/134748102/jofoluf.pdf
- https://tekevifumufov.weebly.com/uploads/1/3/0/7/130739519/a1aa0220501.pdf
- https://suxaniwaxunese.weebly.com/uploads/1/3/4/3/134385499/4008096.pdf
- https://tumunuwixa.weebly.com/uploads/1/3/1/3/131384432/xawib.pdf
- https://vipukawolatu.weebly.com/uploads/1/3/4/4/134486161/xilexedebe_latulu_goladelotatef.pdf
- http://uptodate.site/34671908128mdc8e.pdf
- https://waragorejitise.weebly.com/uploads/1/3/0/8/130813548/6093365.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/3bf7b3a8-c40d-4445-9b09-663d4f7948a3/zevafigudawibusilibezim.pdf
- https://uploads.strikinglycdn.com/files/696a0792-8e04-4734-9734-20f2265c8f5c/96121259831.pdf
- https://uploads.strikinglycdn.com/files/ac1e906e-586f-4bda-bddf-143dd39c5261/evan_moor_first_grade_math.pdf
- https://uploads.strikinglycdn.com/files/66e8d3cd-9451-49df-871d-b3cb0516a3e8/bruce_foods_cajun_injector_electric_smoker_parts.pdf
- https://uploads.strikinglycdn.com/files/3c027461-66e8-4c86-8c2f-5601e426476a/how_to_hack_mw3_xbox_360.pdf
- https://uploads.strikinglycdn.com/files/9e142749-a937-4697-b53e-492a16581cbe/how_to_answer_job_interview_in_call_center.pdf
- https://uploads.strikinglycdn.com/files/26e71571-1645-45ed-b781-3d889a093029/dibemut.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f776.bin09d00180cbdf04f9d970f508dfe3496d3fa047869dc8e40f71f2c96b82446f0a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF776 | 5276 bytes |
font_01_sfnt_off00010985.bin0e8ac7f736c768798d1360fdc802a9c145425a79a0da83a1422fa29d9d3935cb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10985 | 10672 bytes |
font_02_sfnt_off00012e13.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12E13 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.