MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains embedded URLs and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. The document body, though heavily obfuscated, suggests a lure related to 'call center training conversation script pdf'. The presence of numerous external URIs, many on disposable hosting, indicates a link farm designed to redirect users to potentially malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=call+center+training+conversation+script+pdf PDF link annotation
- http://timurberg.ru/reveries_of_the_solitary_walker_sixth_walkbzsfh.pdfIn PDF document text
- http://onsideball.info/algebra_for_college_students_6th_edition_mark_dugopolskinku9o.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461751/normal_60126c2fbd838.pdfIn PDF document text
- http://it50save.info/rujifatujofovatonaxoxuxawhr4k.pdfIn PDF document text
- http://prizyivnik.ru/mugesavizi62e9l.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420037/normal_604a11da25a93.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457582/normal_5fd8222318aeb.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4499635/normal_5ff544bd15052.pdfIn PDF document text
- http://mysteps.online/2013_honda_civic_recommended_maintenance_scheduleeboc3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478683/normal_604858d80099a.pdfIn PDF document text
- http://vizit.store/whirlpool_cabrio_dryer_f1_fault_code5omir.pdfIn PDF document text
- http://topvideo.design/jane_the_virgin_season_5_episode_1_monologue_scripty5ksc.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sirilagewuga/raperetamakugejupi.pdfIn PDF document text
- https://s3.amazonaws.com/dujepav/blender_64_bit_full_crack_bagas31.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8726cfce-3795-421f-9729-bafca1bde657/journal_topics_during_covid_19.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4982d183-e4c3-4ace-b092-19d23630cbe7/setavunukereladad.pdfIn PDF document text
- https://s3.amazonaws.com/wazagidonux/brochures_templates_microsoft_word.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a471fd4-8ae4-4e37-9fa4-0d7980a782a6/wosetugudopivip.pdfIn PDF document text
- https://s3.amazonaws.com/jukezeluf/texolozekisezewe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b57890e-3e9f-471f-9a12-cb8ae969b7db/pazeponiw.pdfIn PDF document text
- https://s3.amazonaws.com/sefiwegegagu/honda_hrx217hya_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81687810-f162-41eb-9be7-f29165d4dfac/rikusidakinorezatasegenok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99e8d351-8a54-499e-bb87-d3bf91264201/words_to_song_the_rising_sun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b432e98-88dd-47d5-9962-0e0e723a89e8/drug_guide_book_for_nurses.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42698f87-8a95-4499-b17b-023b6029e20d/burger_king_allergy.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f698.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF698 | 5288 bytes |
SHA-256: 7cc3dbe744f5fe9c2e05e25041d281cfdac285470b38f7c8a4457e20c908937a |
|||
font_01_sfnt_off000108aa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108AA | 10364 bytes |
SHA-256: 1c87fd8ede30d47121dbae68f32c0ab8f554ef2050059d1c8847ddff5168bad3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.