MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a significant number of external links, many pointing to disposable hosting, indicating a link farm or phishing attempt. ClamAV and ML classifiers strongly flagged this file as malicious, specifically as a phishing trojan. The embedded URLs, such as 'https://kuzutuzo.ru/strik?utm_term=tav+prasad+savaiye+deenan+ki', are likely part of the malicious infrastructure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=tav+prasad+savaiye+deenan+ki
- http://jobware.pro/washington_wizards_nba_scoreboardo9me0.pdf
- http://robugipunebib.mygamesonline.org/62754769451.pdf
- http://harkateine.fun/vevabixo92lh7.pdf
- https://cdn.sqhk.co/gaxumisi/QhdSJGW/uk_malaria_treatment_guidelines_2017.pdf
- https://cdn.sqhk.co/besawevij/bbPhaxb/children_s_beds_for_sale_johannesburg.pdf
- https://cdn.sqhk.co/rarukaboz/jhcgiPT/45091226411.pdf
- http://carluxepaint.site/monitoring_internet_activity_at_workw49c6.pdf
- http://wajofima.mywebcommunity.org/53764319415.pdf
- http://medicinfo.online/what_does_it_mean_if_your_dog_is_thirstyirpxj.pdf
- http://mitedujonajezed.scienceontheweb.net/sawikozufizabezajateli.pdf
- https://cdn.sqhk.co/libobivole/dhb6Xgg/i_am_death_gif.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fedorahosted.org/lohit
- http://www.daltonmaag.com/
- https://4f870d4f-701c-4ec6-bbb3-7277acc5528a.filesusr.com/ugd/fdcb8d_21e60f5233f74156a1c887ecf277eae6.pdf?index=true
- https://71f68c9c-1037-483c-a0ca-f268b7ddd3c8.filesusr.com/ugd/87fdc7_4226d9676cc948688c26cee9cebc174c.pdf?index=true
- https://uploads.strikinglycdn.com/files/294ed6cc-e2a0-4f7c-9b45-9c80956006ff/new_moon_in_capricorn_2021_time_and_date.pdf
- https://uploads.strikinglycdn.com/files/b983a81a-165f-4f9c-b1d5-0a35893bdaa5/mesine.pdf
- https://3df06c22-1e8a-4082-8cc2-a0fdc0609706.filesusr.com/ugd/d86e81_137ae6985ea94b479bb77e438e9638a7.pdf?index=true
- https://e905a76e-7bc1-418c-be29-e8eda1603e86.filesusr.com/ugd/3fb32a_3bc78c853e0d451f96ff2df69b43e229.pdf?index=true
- https://6f81cef9-66a2-447d-9e1d-4c0427ef15c5.filesusr.com/ugd/4d935e_bad238c56b2d40a1a604b967cbc42820.pdf?index=true
- https://uploads.strikinglycdn.com/files/45b3e818-9c8c-4980-a495-38f6169d3d3e/62730740807.pdf
- https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_5ec8ca2f1ac446fbbb7d7f8f180bada0.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013f41.bin17bd61cb95c0c62a1ef08e88d17a52666c66b5def4b14c0d49a470920c0827a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13F41 | 4696 bytes |
font_01_sfnt_off00014f39.bin240b01ea4caa45f57f54ab4d6d5eb6187b906162b2682bc4dcfb9155b206388d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14F39 | 3772 bytes |
font_02_sfnt_off00015adf.bin1ba5adf5e7ef58777270f4742ffabd6085af1c482d8f9d4a4ccf125b3670e77e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15ADF | 12944 bytes |
font_03_sfnt_off0001813b.bincf01c79162087acd870092246e56402999374facdbdb05370075122dcdb7ffb9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1813B | 10836 bytes |
font_04_sfnt_off0001a668.bin8f0e4cc40e189f844ba505870c5743bf61ee9cdf6cb8b14e370866b3c0b868e2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A668 | 16196 bytes |
font_05_sfnt_off0001bb82.bin4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BB82 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.