MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded links, with at least one identified as a malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains text related to search queries, suggesting a lure to external content. The presence of embedded URLs and the heuristic firings point towards a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=what+is+xi+mean+in+chinese In PDF document text
- http://lefibipefazefep.mypressonline.com/vilelumovanigidepe.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4374847/normal_600737a7cb6f9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4447093/normal_603fa47f60a23.pdfIn PDF document text
- http://jesofoma.getenjoyment.net/tinanegulivelezifejoma.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369494/normal_5ff470bdcb541.pdfIn PDF document text
- http://suvuxivenorum.mypressonline.com/airfoil_design_and_data_richard_eppler.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484376/normal_60689b06e5687.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445726/normal_601a87a4877b8.pdfIn PDF document text
- http://gajonedorebuko.mywebcommunity.org/is_there_a_sequel_to_neverwhere.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485163/normal_602b250aa4619.pdfIn PDF document text
- http://mizafaroremida.getenjoyment.net/misuzuvifawukamipit.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_2408cc78a0ed4e4d9e648426b20cac87.pdf?index=trueIn PDF document text
- https://a804c8a8-fdf7-4fba-b19b-c23aecc29597.filesusr.com/ugd/a7074a_daf231af8c6a4ea194fcd3612dd039bd.pdf?index=trueIn PDF document text
- https://6552665f-f3ce-4070-9f47-7b493df4570a.filesusr.com/ugd/3d88c7_2244afbc2ffb45978313a461a5c9e82f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1252bd22-44cc-47f3-8ba6-585baff387f9/27619086690.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/20e7eaed-9fc1-406d-b47d-b205a26bfe9e/33596682089.pdfIn PDF document text
- https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_10dc3105d2d1444b853ca4038302918f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ee4656f4-a8e4-4b19-be4c-dfd9a2418d91/95859599282.pdfIn PDF document text
- https://598a1783-db1d-4ebb-96f5-d3ad23e1e090.filesusr.com/ugd/ae99eb_dc1f15a54ee94cd495b23692801b9793.pdf?index=trueIn PDF document text
- https://070488ba-e3d9-4c74-834b-445551f5513c.filesusr.com/ugd/fb83f1_714e1bc24f784395a7befb67d542cb30.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/05b7dcb6-ec9b-42e3-9d22-57d5b2d58708/fukejab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/403f41de-cc49-4ce8-87ae-ded6976fb624/zoniwizuba.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fdcb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDCB | 44904 bytes |
SHA-256: 4fe5b5baf086a8d387b87b15fb5a8139d10861381b381c3a0b63c8181f2a6dd2 |
|||
font_01_sfnt_off0001862a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1862A | 4992 bytes |
SHA-256: 0f100debd8e51a11c7de5977d999c3938b85a645ada475660710ee27715747c2 |
|||
font_02_sfnt_off00019712.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19712 | 13528 bytes |
SHA-256: 7cf9ba970cb01e4fbbeafa388b7f9a34e1c858934609a7918c916d1b68e77a26 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.