MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a PDF URI pointing to 'midufefew.ru' suggests a phishing or malware distribution attempt. The heuristic 'PDF_SEO_LINK_FARM' indicates the PDF contains numerous external links, likely to further malicious sites or to obscure the primary malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9859
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/award?keyword=an+underground+education+pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f2977f12-8b49-4b28-b2e9-5ed288619425/sugezivenokexavomixog.pdf
- https://203aa715-7352-46b1-b16b-5d0aeeaa27a2.filesusr.com/ugd/0582e0_0998501223544db3a2729689bd8a63b9.pdf?index=true
- https://uploads.strikinglycdn.com/files/bfb18d2e-2614-437e-896a-a71754c58daf/dejakomajeguvowuwagenab.pdf
- https://uploads.strikinglycdn.com/files/640aa711-09f8-4437-9ac9-5c2cce608521/sig_sauer_p229_40_cal_extended_magazine.pdf
- https://uploads.strikinglycdn.com/files/d9d448e6-e41d-4850-90e7-07c456b4c8e3/is_call_me_by_your_name_rated_r.pdf
- https://46a1ac71-481d-4a85-b709-d40f3a189542.filesusr.com/ugd/143c98_79815866ed774f1d888bdc929639dc37.pdf?index=true
- https://s3.amazonaws.com/sinamozagemoger/55653886116.pdf
- https://uploads.strikinglycdn.com/files/b9dd0bd7-8c96-435a-90d6-a66635b32714/who_wrote_the_quran_first_time.pdf
- https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_9089722b08264ca4aa9e26adc633f656.pdf?index=true
- https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_3fe5427ec3c44efcbbcadecc68b31ef2.pdf?index=true
- https://uploads.strikinglycdn.com/files/34c43a55-3641-423f-839b-f63f39935818/16761072799.pdf
- https://uploads.strikinglycdn.com/files/36792f14-b4ba-488d-93cb-b70c31f1a78b/jandy_heater_troubleshooting_guide.pdf
- https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_1823cbfdac4a4f1f9d6f6248aa21bfcf.pdf?index=true
- https://uploads.strikinglycdn.com/files/0ddbff27-6caa-4bff-bf3e-15b72f7e800b/how_to_wear_ergobaby_360_cool_air.pdf
- https://05b56818-8b0b-4484-a411-4f1234233f1c.filesusr.com/ugd/e49726_8d7712aebeb444f093d7bf25c111b5b1.pdf?index=true
- https://s3.amazonaws.com/dusined/dutapoxebotamixenujotamal.pdf
- https://s3.amazonaws.com/goneduzum/roller_skate_wheels_guide.pdf
- https://1639490a-f715-481e-9fb1-af38d332269b.filesusr.com/ugd/a59130_01742c48f63c4bbaa44025b610170087.pdf?index=true
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00021e64.bin3c40a3c34620a22c44c82b33cc9f87ba7a237bd2e0b2de3e365383d75adebb37 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x21E64 | 5100 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.