MALICIOUS
254
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file contains multiple links to external websites, many of which are flagged as malicious or part of a link farm. The document body, though heavily obfuscated, contains text related to a 'Lasko tower fan assembly' and references wkhtmltopdf, suggesting a lure to a phishing or malware distribution site. The presence of numerous PDF links and a critical redirector link strongly indicates a malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/wix?keyword=lasko+tower+fan+assembly In PDF document text
- https://cdn-cms.f-static.net/uploads/4448115/normal_6013df0f382b7.pdfIn PDF document text
- http://gasufulezexe.22web.org/format_curly_braces_python.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449187/normal_5fff184635752.pdfIn PDF document text
- http://mananeje.66ghz.com/dark_souls_1_character_creation_face_guide.pdfIn macro / runtime command snippet
- https://static.s123-cdn-static.com/uploads/4387229/normal_6003288a79993.pdfIn PDF document text
- https://zizovotitimojuv.weebly.com/uploads/1/3/2/7/132712514/3960450.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4419430/normal_5feb7a8a45e81.pdfIn PDF document text
- http://degitowexara.iblogger.org/xuruxeveselodibot.pdfIn PDF document text
- https://datevasipagudi.weebly.com/uploads/1/3/0/8/130874205/db52e55b16f1c9.pdfIn PDF document text
- http://wotegop.22web.org/literary_devices_definition_list.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417806/normal_5fcee4682ed75.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408587/normal_60329f7987c50.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419633/normal_6042b6272f051.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4409244/normal_5fffe4d64d9fb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453344/normal_6014cd887dee5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uIn macro / runtime command snippet
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f17b4888-c45c-43c8-9b3c-f948a61ee650/2021_ford_mustang_gt_premium_for_sale.pdfIn PDF document text
- http://xisevigelunadiv.epizy.com/vehicle_cartoon_video.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9bead42f-5ede-4c94-a177-ae0c1fd5fb61/certified_fraud_examiner_certification_online.pdfIn PDF document text
- http://kurejob.epizy.com/singer_quantum_stylist_9960_bobbin_winding.pdfIn PDF document text
- http://kugesiv.epizy.com/python_for_data_science_beginners.pdfIn PDF document text
- http://bopuxenuxesozu.rf.gd/aha_cardiac_arrest_guidelines_2017.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c82d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC82D | 5252 bytes |
SHA-256: 0ab5d25ea04a0baf83af4a61f07010332388472cb0cf2930b514ccdf930c40a3 |
|||
font_01_sfnt_off0000da0b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA0B | 9964 bytes |
SHA-256: b9e1dfc3e887cdd77ad1e1727c52621fa60a5f6a85d12444c01038a108f1a794 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.