MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with one prominent URL advertising a "free script executor" for Roblox, suggesting a lure for potentially malicious downloads. ClamAV and ML heuristics also flagged this PDF as malicious, specifically as a phishing trojan. The presence of embedded links and the nature of the advertised content strongly indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=free+script+executor+roblox+2020+no+virus PDF link annotation
- https://cdn-cms.f-static.net/uploads/4493266/normal_601702c89e31c.pdfIn PDF document text
- https://gedorizifoxe.weebly.com/uploads/1/3/1/6/131607240/rarifuguxet-vuveli.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488581/normal_60421f06adc25.pdfIn PDF document text
- https://fuxarudoniw.weebly.com/uploads/1/3/5/3/135350341/mesofuwar-zatejutetalox-vazukenapeb-sisokumoze.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387571/normal_60284059430b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448124/normal_60331c3002556.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414515/normal_60493498f0456.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477878/normal_602fe8103e78f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393521/normal_60364ee5dfe53.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411246/normal_605db33ae7b5a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457843/normal_604b15df87d55.pdfIn PDF document text
- https://vixoketos.weebly.com/uploads/1/3/1/4/131453026/2b662d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410020/normal_5fd63b1a3026d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449973/normal_60241ff3b475d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f930fee6-04a2-4c16-8653-031a1548d78e/what_is_esoteric_mean_in_english.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28616819-e3b1-40fd-a6fa-abd8a5a9b0ea/23553121877.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8bde9399-53f1-4827-ab26-792429fb3d7e/craftsman_dls_3500_carburetor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0cdc761c-6d4b-44b0-94a9-de3bd44f4bb2/what_is_a_financial_performance_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91e702bd-1e01-482b-b2c1-521bb69ba3b9/rujonakuxivegamikaxix.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64168647-82bd-47fa-a5be-1cd7bf549322/how_to_check_list_of_files_in_command_prompt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ebd004a-1833-4fd7-aa5e-22356bcba63b/are_beats_pro_better_than_studio.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ceabcda5-0b7d-423e-b195-fb302f19882b/best_computer_science_engineering_colleges_in_canada.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dd6b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD6B | 5216 bytes |
SHA-256: 69873b7b2c33e8f8bc9e5c1f577cc1f4cb1de78357016e20e70cba6be36e7b59 |
|||
font_01_sfnt_off0000ef3d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF3D | 2916 bytes |
SHA-256: 1e249368d708c58cae3c8c45f322bf9ffa5898ba517b37131c004401a82912ef |
|||
font_02_sfnt_off0000fbaf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBAF | 10876 bytes |
SHA-256: 33467a5c2fabcfb5f0f961de746c939b8f1830461d1cfee79025217af02de9f9 |
|||
font_03_sfnt_off00012117.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12117 | 16068 bytes |
SHA-256: b1615e29a4fe6c7320d553a30418b4fece26933a192be804fa4a6c1955e67a67 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.