MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with a prominent one identified as an SEO redirector for a "free-download phishing" lure. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links suggest it's designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=math+by+myself+center+ideas PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://a1d3e036-d9a1-4be1-9d2f-eedbb581cb22.filesusr.com/ugd/3ce946_fd9b43815af147109c7b328f01043441.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/323fe48f-7b03-4c8c-8893-3790ccf0e56c/607350038.pdfIn PDF document text
- https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_a98d2423b12c44eda4ff84b65c8d1fd9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/23ebf395-5deb-4054-956b-9b508dd87580/2012_hyundai_sonata_hybrid_sedan_4d_for_sale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/399711d1-cb8d-4ce4-961f-5234ae4afd73/blackdecker_st5530-gb_corded_grass_strimmer_550_w.pdfIn PDF document text
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_b10244eb7c85421c88da3de928aaf55d.pdf?index=trueIn PDF document text
- https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_a4e7303abba24c8f88d2c885745f27e2.pdf?index=trueIn PDF document text
- https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_bd62de1c7adf4f4a99ec0aaefe3efb0d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8a8c0206-29a5-49b4-98fe-24e4a8a81a63/pifusesokezinozisewa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f89dd246-9cad-44e4-9dfc-b91116681f4e/who_makes_american_standard_water_heaters.pdfIn PDF document text
- https://964beff5-d24f-450a-94e2-fa7e9faef44a.filesusr.com/ugd/61158f_924df9c5721f4dd0af807319ff37f164.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b0ca432f-5f46-48f2-9218-2de27d60bdc7/the_power_of_love_celine_dion_lyrics_translation.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d702008-4b79-4ce1-bf74-a4acd762c6df/guns_germs_and_steel_documentary_watch_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69b7e77a-f702-4f13-8eb8-2afa5d0411d2/boating_knots_steps.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f0044d1-402e-4d64-9d6e-1f85d2752ea9/operations_management_degree_curriculum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b5c58a2-8267-4e7e-a7d0-6fbd9915dbf4/william_faulkner_absalom_absalom_analysis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4c4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4C4 | 5188 bytes |
SHA-256: a78c7580222cd26e60a2916b138bf8e0cd83f7545bac18236b4c563edb1e5a44 |
|||
font_01_sfnt_off0000f643.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF643 | 10860 bytes |
SHA-256: 42e054d96b54bb4a9dabc488fb53176a79c8d53577e2dd56535f721476834800 |
|||
font_02_sfnt_off00011b13.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B13 | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.