MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains embedded URLs, with one prominent URL pointing to a suspicious domain that appears to be part of a phishing or scam campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. The presence of multiple external URIs and a link farm heuristic further supports a malicious classification.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=2006+gmc+envoy+xl+for+sale PDF link annotation
- https://static.s123-cdn-static.com/uploads/4367279/normal_5ffe8560294c8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426090/normal_606832f1787f7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4477409/normal_5fced46a2971c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4447658/normal_603f992623a77.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500189/normal_6039180c8efd8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://rolawitakomot.rf.gd/anexos_icao.pdfIn PDF document text
- https://14319df0-7947-4f0d-bbb3-eaa17d5eb23e.filesusr.com/ugd/c45f38_7d22b42ad8b84daea226238cf74ae333.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/93d5e12c-31ab-458c-9587-94efc19d9707/94532494239.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4faeb423-8c5a-46f1-a9b3-ac17812bcbff/how_to_study_for_pmp_certification.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e17d4df-ad96-43e5-bfa5-ae216bd5682b/how_to_write_a_lincoln_douglas_debate_case.pdfIn PDF document text
- http://zegapoja.epizy.com/asme_ansi_b16_standards_of_pipes_and_fittings.pdfIn PDF document text
- http://sikopenopod.epizy.com/how_to_day_trade_penny_stocks_on_etrade.pdfIn PDF document text
- https://fed4949e-3809-4fc0-a28b-84c5d390f589.filesusr.com/ugd/94482e_7e1a7f47dcd7460f9da14a4934fbf086.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/13bce2e2-b46b-4d89-9fc8-38d4df5a8fd8/black_and_decker_hedge_trimmer_warranty.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/043c5969-78ec-4c6a-a14a-2865637d4dd0/4133741098.pdfIn PDF document text
- https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_aeefe658c5af44bd9049d5c518243752.pdf?index=trueIn PDF document text
- http://fenozenexow.epizy.com/dragon_ball_android_13_14_15.pdfIn PDF document text
- https://b3695a61-a5b7-457a-863f-99677d03e0cc.filesusr.com/ugd/f2a82d_f95f3ac3ec7f4ce2bba13628d2e40224.pdf?index=trueIn PDF document text
- https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_64ece802f54342b19683625184d3525d.pdf?index=trueIn PDF document text
- https://712e085e-8422-4094-ae2e-709d430f1fc9.filesusr.com/ugd/bf8edb_00d6a7bfcc9d48f68a15de8ea2f710db.pdf?index=trueIn PDF document text
- https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_6180dc00ab3e43b0a47b05de9844d4d0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1eac257f-0c5d-4877-b8ea-ebfe56a908c2/is_the_toyota_yaris_a_reliable_car.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cb41.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCB41 | 5764 bytes |
SHA-256: 6d1df50a10bda6dd84f7f27b84fe1f6e661687194fc2cf8caa968e70c48149e5 |
|||
font_01_sfnt_off0000dee8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDEE8 | 10032 bytes |
SHA-256: d1a8ddee44c2b457e78a562274628718ffa28fbb306876f85b922107ce295b41 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.