MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://dafemum.ru/strik?utm_term=jvc+kd-r370+installation'. This URL is presented in a context that suggests it is part of a phishing lure, likely attempting to trick users into clicking it for installation instructions. The ML classifier and ClamAV detection further support the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=jvc+kd-r370+installation In PDF document text
- https://cdn-cms.f-static.net/uploads/4408720/normal_6029fcc655ddf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379053/normal_6025817277950.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368969/normal_603bf6822ecd2.pdfIn PDF document text
- http://rufawefojag.sportsontheweb.net/cpwd_works_manual_2020.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4450037/normal_5fd03a606f692.pdfIn PDF document text
- http://rilomenininun.getenjoyment.net/68186158609.pdfIn PDF document text
- http://rigudozefogo.mypressonline.com/peds_response_form_in_portuguese.pdfIn PDF document text
- http://vagebunav.iblogger.org/anatomy_of_monocot_and_dicot_leaf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413016/normal_6038437a93aa1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/ditiruz/graphing_straight_lines_worksheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e0a396d9-fef8-4215-956f-ee6837a29c31/how_to_pair_logitech_mouse_without_unifying_receiver.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/130386a2-4ded-4808-b472-a6e5ac9c88d7/turozovuvegalug.pdfIn PDF document text
- http://sitasuwa.epizy.com/31893225243.pdfIn PDF document text
- https://s3.amazonaws.com/kudowo/office_email_writing_samples.pdfIn PDF document text
- http://jitetiwax.rf.gd/24293785411.pdfIn PDF document text
- http://togujekunigek.rf.gd/android_unbound_xml_namespace_prefix.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/527492a9-eb1f-4db8-b13a-5061570b07a1/92557144188.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe1c26fe-714b-48d8-ae62-ab241530cd7d/21734211452.pdfIn PDF document text
- https://s3.amazonaws.com/xufujofaleki/bimanual_intensive_training.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4707b8ee-1c36-486c-b1b2-627174c69ab0/karcher_parts_manual_download.pdfIn PDF document text
- http://polutojufet.epizy.com/how_to_reset_a_maytag_bravos_xl_dryer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e92d7239-97d0-46ec-88b8-dd791fda6b34/45554305680.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8772b7c4-2ca5-461b-a6bc-0a485f371da1/sat_practice_essay_5_sample.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6016e6b6-9642-441e-92fa-02c5112df33a/do_landline_phones_still_exist.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9f3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9F3 | 5464 bytes |
SHA-256: d5ce82846fce30c71281dc66bedf19da398e11b225224ef42bc2d56520af59f3 |
|||
font_01_sfnt_off0000fcaa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCAA | 11268 bytes |
SHA-256: a889e5f36fd41692e4ffe2191dde06c235b632494287924eed4374c542e255e8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.