MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URLs, such as 'https://resalured.ru/strik?utm_term=how+do+you+simplify+square+roots+with+fractions', are likely used to redirect the user to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=how+do+you+simplify+square+roots+with+fractions PDF link annotation
- https://cdn-cms.f-static.net/uploads/4472186/normal_6040dbc283d1e.pdfIn PDF document text
- https://navojinalano.weebly.com/uploads/1/3/4/7/134755450/2072092.pdfIn PDF document text
- https://nofuzuvovakiba.weebly.com/uploads/1/3/1/3/131379181/puzisokesozak-dobuxok-mifelas.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4459921/normal_5febc2ca21936.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443824/normal_605d5c5c0cb5a.pdfIn PDF document text
- https://kebiluxo.weebly.com/uploads/1/3/1/4/131455508/ditoxoreze_liwujataf.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495841/normal_5febd00be607f.pdfIn PDF document text
- https://sefariduzaki.weebly.com/uploads/1/3/4/6/134665623/8528956.pdfIn PDF document text
- https://kezopepeza.weebly.com/uploads/1/3/4/3/134332650/nizoxodotuzoxi-xemoge-retifuvigi-jepebejixaxamun.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4368782/normal_5fc7f98823b67.pdfIn PDF document text
- https://romagazep.weebly.com/uploads/1/3/4/7/134759296/boxutijapif-suzazipofufo-wunefirinomed-jived.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/21dc13ee-b0d4-4153-acac-54368153850c/fool_on_the_hill_lyrics_youtube.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04979494-920c-4c16-a37e-eaaa878d3a81/microsoft_word_vba_document_properties.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/abbf84f9-4a26-4bdd-8085-9961fe1552d0/immanuel_kant_on_aesthetics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/65dcb860-26e0-4a9c-8168-f4f63df57099/nanapazomegakumefa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f40b3735-2476-4eed-81aa-4842836a098b/bamogi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4dec6557-8257-473a-b118-c888a96a7679/dell_t3500_data_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64a94b27-e415-4582-ba98-9b897d91915a/true_pizza_prep_table_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a9ac560-689f-4322-ba6a-e0f6d1f7205e/o_que__resumo_critico.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec3f1a84-675b-4bfb-b1d6-a73b919f8dcf/354764521.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d254.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD254 | 5560 bytes |
SHA-256: beb537ee54293ac5ff754b5f740d22b11faefdb3a7917850b91d1673466ce3eb |
|||
font_01_sfnt_off0000e52b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE52B | 11156 bytes |
SHA-256: 2dfb004d6176a0a31cefa6a36f50919c729dde9fef899fc3164258ceca0c201b |
|||
font_02_sfnt_off00010b5f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B5F | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.