MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a mass external link farm, with numerous URLs pointing to disposable hosting and redirectors, indicating a phishing or scam campaign. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a phishing lure, likely using JavaScript for obfuscation or redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/strik?utm_term=what+is+the+average+salary+of+a+surgical+nurse PDF link annotation
- https://cdn.sqhk.co/pikikunifav/gdgigev/28858758730.pdfIn PDF document text
- http://pisufixefonof.scienceontheweb.net/biofertilizer_production_technology.pdfIn PDF document text
- https://cdn.sqhk.co/moturalogupe/jchiujc/42999603012.pdfIn PDF document text
- http://itdiscount.info/65449157720mr4a2.pdfIn PDF document text
- http://tixshopclub.fun/grigori_grabovoi_methode_book71x76.pdfIn PDF document text
- http://kudukudimox.sportsontheweb.net/98681975283.pdfIn PDF document text
- http://bachanalytics.com/62948696851fdi4i.pdfIn PDF document text
- https://cdn.sqhk.co/fefuxumito/bjivG5L/wonafudagevukuwen.pdfIn PDF document text
- https://cdn.sqhk.co/wobuwaseja/9rijhij/walew.pdfIn PDF document text
- http://maxist.ru/contabilidad_de_costos_estado_de_resultados_ejerciciosr4yhs.pdfIn PDF document text
- http://soldatskaya6.ru/how_to_get_couples_counselingsva9t.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/dba27d35-8a85-426c-a7c8-90608795f7fd/92692611878.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad7baec4-6a00-4ccd-91d7-4f9a7a7b2a65/japojera.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2496870-b80f-4b52-8e50-3f3839d1eac8/how_to_get_marker_off_textured_walls.pdfIn PDF document text
- https://s3.amazonaws.com/besafefaf/kovupemomijidewulesid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73a22c16-31ac-4733-93e8-6e7af40ee210/inkscape_for_mac_m1.pdfIn PDF document text
- https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_e2bae42446384c56b16d226443ce4089.pdf?index=trueIn PDF document text
- https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_8c48837751ed4042a21432baa747d5d5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/dc747cf7-58b4-4593-88d4-79ed2bd015e8/saxudaxizawazusiwudutowig.pdfIn PDF document text
- https://s3.amazonaws.com/toguvaju/bedwars_blockman_go_apk.pdfIn PDF document text
- https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_a155fcffa73e4d8aa2db77679dffdd0a.pdf?index=trueIn PDF document text
- https://f8ba888e-8f71-4fde-8303-550399648f4e.filesusr.com/ugd/17ce20_39e082cd7c054df5a8716c2223e08983.pdf?index=trueIn PDF document text
- https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_7a874d6e8dc342428e471ed0a15361fa.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f408.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF408 | 5320 bytes |
SHA-256: 17756a8bb71d477ee2d23c1909693bbba24b63c2d4f2a185a11ad598b2f85b04 |
|||
font_01_sfnt_off00010635.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10635 | 10792 bytes |
SHA-256: 161416cf941124d902968144d2aba220ae285d3881b74ddfbddcce1356d38684 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.