MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with a primary redirector identified as 'https://lozipotod.ru/award?keyword=centralisation+et+d%25C3%25A9centralisation+pdf'. This URL is part of a link farm designed to appear as a legitimate document download, but it is flagged as a phishing lure. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/award?keyword=centralisation+et+d%25C3%25A9centralisation+pdf PDF link annotation
- https://cdn.sqhk.co/rutesawir/eUYhcic/hattrick_full_movie_iranian.pdfIn PDF document text
- https://cdn.sqhk.co/woguwubege/ghyxyaz/tozaluxatek.pdfIn PDF document text
- https://cdn.sqhk.co/xogovofofi/0JgLr8n/whatsapp_video_call_on_android_tv_box.pdfIn PDF document text
- https://cdn.sqhk.co/mikedeto/aVAgign/gba_emulator_pc_games.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tiniruru/furuz.pdfIn PDF document text
- https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_44c37ea320264308ad8fc3ef75beb121.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vufupu/79960425636.pdfIn PDF document text
- https://s3.amazonaws.com/datarofapakil/14387585430.pdfIn PDF document text
- https://s3.amazonaws.com/mutirexa/4_panel_brochure_mockup_template.pdfIn PDF document text
- https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_d6f51a465f1c404db3fdc4400546406e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jiwotarotavuz/saririmimatiruxurisuteziz.pdfIn PDF document text
- https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_7cba4f26d6594c1a8a5b57708810f07c.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vunizi/73538564329.pdfIn PDF document text
- https://s3.amazonaws.com/ropidadegaxut/file_from_sftp_server_using_vb._net.pdfIn PDF document text
- https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_8bddf90732474d6fbf20757ec3196d0c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/de61adea-1c79-453a-b006-6f885ed0f05c/60105501703.pdfIn PDF document text
- https://d670dda7-df53-4ef1-8eda-d3256df28744.filesusr.com/ugd/dbbbec_3e0d28885e4b416cb8529eb42aca341f.pdf?index=trueIn PDF document text
- https://d86ad34a-7df2-4f47-937b-a12ab5abc0fa.filesusr.com/ugd/8cbfce_043f35a7e6d64255820b1ce68a927b11.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/778e0451-12f5-4216-bac0-b48e1f68ce79/16996227337.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0c86426c-c5e0-47de-baa3-c4da667a3dd1/16689425400.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010a2c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A2C | 5196 bytes |
SHA-256: ce1eeeccb2324da4aa66aab903f6944663027f57bb98c8b78610a2b2d5614d9b |
|||
font_01_sfnt_off00011b9a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B9A | 9912 bytes |
SHA-256: dcf74342b08c9345d2eacfc25cf7e5d1ff3aa172c2cc6695e4ba1b6b247ebfcf |
|||
font_02_sfnt_off00013dbe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13DBE | 16204 bytes |
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.