MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded links, with at least one identified as a known malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains text related to 'Apush period 3 timeline', suggesting a potential lure for educational or administrative content, which is then used to redirect to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=apush+period+3+timeline In PDF document text
- http://casserlabs.xyz/13433884556ynrca.pdfIn PDF document text
- http://icub.tech/before_the_throne_of_god_above_selah_chordsz2xnj.pdfIn PDF document text
- http://casbah2point0.com/buongiorno_italiaijeik.pdfIn PDF document text
- http://psylath.com/18796806795nulr3.pdfIn PDF document text
- http://teaitalis.space/xafoduzizakusogobosojerhuxqh.pdfIn PDF document text
- http://linorusani.iblogger.org/tilazekonixopitudepegu.pdfIn PDF document text
- http://helplnstagramoffice.com/665767486219sfdz.pdfIn PDF document text
- http://rukozhop-guide.com/fallout_4_looks22fs2.pdfIn PDF document text
- http://goldenframecollision.com/portal_frame_analysis_examplehimqh.pdfIn PDF document text
- http://letgtma.bid/decolonizing_the_mind_ngugi_wa_thiongo_summary8nufd.pdfIn PDF document text
- http://djami.ru/sony_dsc-f717_memory_stick_compatibilityvbfbw.pdfIn PDF document text
- http://moscow-siberian-force.online/mcquay_microtech_ii_operation_manualiuf33.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://748e6e98-33e2-4bd1-95aa-01ea3505a154.filesusr.com/ugd/704f6c_feff93b485a543028b4a7442381bec08.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ba7ab2e7-560a-4e93-8af7-d050750d55f4/whirlpool_refrigerator_service_call.pdfIn PDF document text
- https://1c437d0a-cccb-4a8a-93f1-39e0b5126915.filesusr.com/ugd/b91566_46d574fa6c8f44f79e257af2ece08dc0.pdf?index=trueIn PDF document text
- https://2a4065d7-883d-43e8-a524-7ce9aa4b4e88.filesusr.com/ugd/ccb1c6_b6dc276f69d64d70b270f32e5b908a00.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e9618e3a-c3fd-433d-8b65-2cd3311dda92/la_leccion_de_august_resumen_personajes.pdfIn PDF document text
- http://xanokilil.rf.gd/30348304484.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f4ae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4AE | 5144 bytes |
SHA-256: 8e83920c7ec8bcd337a543634eaac762ffe01e08911ac83d4ec40386680b330c |
|||
font_01_sfnt_off000105fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105FB | 1716 bytes |
SHA-256: c0e39f44321a474cc328806e737293db5bfd2873d0430c567f64257ef24eb06f |
|||
font_02_sfnt_off00010e86.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E86 | 10684 bytes |
SHA-256: adb2af93ba9fcdb6cb57e66b51af68bcaa3b5c33bf81c5976a545a44a0fb3b85 |
|||
font_03_sfnt_off00013325.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13325 | 16204 bytes |
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.