MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.7904
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://podar.co.za/XSRYdR1H?utm_term=centro+escolar+university+dentistry+uniform PDF link annotation
- http://bc-nosingtasting.com/bestanden/files/55567356871.pdfIn PDF document text
- http://racecross.com/upload/edito_fckeditor/file/fegaxirofekov.pdfIn PDF document text
- https://www.voyagegroupepascher.fr/public/kcfinder/upload/files/26409197709.pdfIn PDF document text
- https://greenlakecruises.com/ckfinder/userfiles/files/53567563594.pdfIn PDF document text
- https://projekt-lesen.de/userfiles/file/poxefif.pdfIn PDF document text
- http://portamarioarchitetto.eu/userfiles/files/mubedilatawabeju.pdfIn PDF document text
- https://arerp.kr/data/file///gutab.pdfIn PDF document text
- https://rowanmkt.com/Uploads/ckfinder/userfiles/files/85136691769.pdfIn PDF document text
- https://home-consult.lu/userfiles/files/gusazitapomebijifalawaxe.pdfIn PDF document text
- http://germainelecocq.it/userfiles/files/koverilumabibofak.pdfIn PDF document text
- http://bashtourizm.ru/uploads/files/fawikudexedewurenado.pdfIn PDF document text
- http://max-metal.pl/gfx/file/12179673195.pdfIn PDF document text
- http://xn--pr3b03lcdvwu9dpynqkc.com/DATA/file/20220209095433.pdfIn PDF document text
- http://polletnv.be/uploads/files/rilinedizenit.pdfIn PDF document text
- http://accuway.yun2u.com/upload/files/muralituliwidolerasoduwab.pdfIn PDF document text
- https://miminku5.com/contents/files/62568924510.pdfIn PDF document text
- https://textosl.com/upload/editor/file/54422351738.pdfIn PDF document text
- http://www.introspekta.si/ckfinder/ckeditor_uploaded_files/files/42759707165.pdfIn PDF document text
- https://lrsinc.co/userfiles/file/medifijapusobigitabopami.pdfIn PDF document text
- http://www.premiumimport.nl/ckfinder/userfiles/files/puvonumezefowajuvudem.pdfIn PDF document text
- https://www.getfitcrew.com/wp-content/plugins/formcraft/file-upload/server/content/files/162152550a5bd8---xodofatoveta.pdfIn PDF document text
- https://maturana.cl/upload/file/gagimaburip.pdfIn PDF document text
- http://dbrostechnology.com.np/dbros/public/ckeditor/kcfinder/upload/files/12626654129.pdfIn PDF document text
- http://daejonggyoyc.com/userfiles/file/20220207175541.pdfIn PDF document text
- http://globalnetworks.de/www.galabau-poscher.de/main/preview/ckfinder/userfiles/files/14746165676.pdfIn PDF document text
- https://primer-spb.ru/files/files/jejutofa.pdfIn PDF document text
- https://innovativallatgyogyszer.hu/fileok/file/59972286518.pdfIn PDF document text
- http://eggtesting.com/admin/uploads/file/22989985240.pdfIn PDF document text
- http://blackswaninfotech.com/kcfinder/upload/files/sinolituve.pdfIn PDF document text
- http://mvpvo.ru/userfiles/file/sedovur.pdfIn PDF document text
- https://readxyz.org/wp-content/plugins/super-forms/uploads/php/files/663275d470ed65a4d90b5d60f9d531a2/butesunifolabalukakexesem.pdfIn PDF document text
- https://leifs-auto.dk/images/file/79490563777.pdfIn PDF document text
- http://blackhorsesc.pl/userfiles/file/modaronofawoze.pdfIn PDF document text
- http://domusanna.it/userfiles/files/tivolekofifiratimu.pdfIn PDF document text
- http://www.barczyk.plwww.sgpm.krakow.pl/aanewsysn/kcfinder/upload/files/bajuzitemugavibexutuven.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00031afa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x31AFA | 10948 bytes |
SHA-256: f57cb49d79b38750f54151d7f2593fd89f98b1ea904a95322af3467793b0fb10 |
|||
font_01_sfnt_off00033468.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33468 | 18232 bytes |
SHA-256: 754bb414571f4bd65a3313f1e4da10e7aa89bf71cd387cec650b5623e2f4d8e4 |
|||
font_02_sfnt_off000363bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x363BC | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.