MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.7163
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://loheb.co.za/XSRYdR1H?utm_term=allen+assertion+and+reason+for+aiims+pdf PDF link annotation
- https://812423.qqtogeljackpot2.com/contents/files/wuzigixazodusuna.pdfIn PDF document text
- http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/162118a15638df---tuninolekilobawemulenef.pdfIn PDF document text
- https://inicio.camaragranada.org/administracion/kcfinder/upload/files/85205629420.pdfIn PDF document text
- http://www.aceitunasdelguadalhorce.es/ckfinder/userfiles/files/nagewidutiwifije.pdfIn PDF document text
- http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/161fdbb77ac5d3---gusidosasewibafasinudi.pdfIn PDF document text
- https://sealordhotels.com/ckfinder/userfiles/files/bebunefiruse.pdfIn PDF document text
- http://akgdsgfly.pretty-match.com/upload/files/walibi.pdfIn PDF document text
- http://gzky.cn/dubeite/ckfinder/userfiles/files/20220210_010405.pdfIn PDF document text
- http://stavebniny-pyramida.cz/admin/upload/files/pepobemorenuromixuruw.pdfIn PDF document text
- http://bygreenpure.com/userfiles/file/15116772674.pdfIn PDF document text
- https://basealimentare.it/webroot/files/fck_uploads/File/zarawimasipul.pdfIn PDF document text
- https://menuiserie-sainte-anne.fr/userfiles/file/zipavefanup.pdfIn PDF document text
- https://full-e.com/app/webroot/userfiles/files/20220227_144652.pdfIn PDF document text
- http://gianniarnaudo.com/userfiles/files/lemek.pdfIn PDF document text
- http://provia-events.de/pics/fotos/1/file/dewafunileje.pdfIn PDF document text
- http://trailerdepot.ca/site-uploads/29023216496.pdfIn PDF document text
- http://www.mardancci.com/assets/ckeditor/kcfinder/upload/files/94007959212.pdfIn PDF document text
- http://bellina.pl/userfiles/file/netefubevevi.pdfIn PDF document text
- https://digbijoynath.in/uploads/userfiles/files/25804164396.pdfIn PDF document text
- http://testwebb.net/kcfinder/upload/files/54087699807.pdfIn PDF document text
- https://theelementrama9.com/userfiles/files/gimutolakedu.pdfIn PDF document text
- http://sujitonweb.com/userfiles/files/91449318722.pdfIn PDF document text
- https://citrasas.com/ckfinder/userfiles/files/71094328590.pdfIn PDF document text
- http://hzeiger.com/userfiles/file/zuxadexazeligonul.pdfIn PDF document text
- https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/4477570a250a5ef88f22e21e20c7ff2c/kelibipatafimoserelo.pdfIn PDF document text
- http://misosmile.com/upload/editor/files/3002327154.pdfIn PDF document text
- https://eliteprotectiveservices.net/ckfinder/userfiles/files/28375403366.pdfIn PDF document text
- http://www.peritaonline.es/ckfinder/userfiles/files/nuvugumizozu.pdfIn PDF document text
- http://087334211.kad.tw/kads/ckfinder/userfiles/files/sozokaguposavajuwetited.pdfIn PDF document text
- http://eternaseguros.net/files/files/vewejugefefobudu.pdfIn PDF document text
- https://www.agro-zavod.ru/app/webroot/js/ckfinder/userfiles/files/mexenipu.pdfIn PDF document text
- http://aquaclub.hu/userfiles/file/81470108567.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004bf87.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004bf87.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004bf87.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4BF87 | 10640 bytes |
SHA-256: e193dfb1e1e89bbc8bef70bd0f33f3f15d09b2db303dadd9564eb059fbaf004c |
|||
font_01_sfnt_off0004d7dd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D7DD | 18540 bytes |
SHA-256: 04b14c85a8acce856d6c9c1abd871c55b79a854f2a1cdf1ce53cdab7cbb2d664 |
|||
font_02_sfnt_off0005087b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5087B | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.