MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded URLs, many pointing to disposable domains, and is flagged by heuristics as a link farm and potentially malicious. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to 'paranormal romance books' and includes metadata from wkhtmltopdf, indicating it was likely generated programmatically to host these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.7828
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=best+paranormal+romance+books+adults
- http://baderezu.scienceontheweb.net/bus_116.pdf
- https://cdn.sqhk.co/pifajaloro/jcZ4E5k/ghostrunner_ps4_release_date.pdf
- https://cdn.sqhk.co/desogepupema/hc0FKii/48570527380.pdf
- http://foselosen.sportsontheweb.net/concepto_de_enfermeria_en_salud_publica_segun_la_oms.pdf
- https://cdn.sqhk.co/nupegefozub/yhe0ghK/brilliant_earth_moissanite_rings.pdf
- http://zonizubiro.getenjoyment.net/28742270750.pdf
- http://jufumabenosenup.iblogger.org/19493675165.pdf
- https://cdn.sqhk.co/jetirivotu/dyNDDNK/62202716236.pdf
- http://forovasax.medianewsonline.com/24786325390.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zitawajizotifam.epizy.com/93041553835.pdf
- https://9c12218e-e157-4070-b33f-4467b3cb42bb.filesusr.com/ugd/0c60a0_973226b54db74234bf66d2f54f78fa3c.pdf?index=true
- http://tojederetesez.epizy.com/luzizafal.pdf
- https://s3.amazonaws.com/jivamubug/chief_executive_officer_cv_template.pdf
- http://wozimape.onlinewebshop.net/agneau_de_dieu_qui_prends_nos_pchs_partition.pdf
- https://s3.amazonaws.com/lososimap/50430499902.pdf
- http://dudaturid.rf.gd/mla_8_in_text_citation_report.pdf
- https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_66dba781cf3b4554a199bcf87f88cc1e.pdf?index=true
- https://s3.amazonaws.com/sefepugolupalax/disney_cast_member_holiday_discount_2020.pdf
- https://b3709dad-42f4-4621-9b7e-74d31ca978cd.filesusr.com/ugd/f91cf1_ae9090d879d74659a555adab2d5ff6f8.pdf?index=true
- https://dce09894-55e7-49e1-9c43-b94069c58f23.filesusr.com/ugd/11ae40_f025d60b28f94a3aa2a4c3e7b718d1b3.pdf?index=true
- https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_e530819a01dd452096922029abd07431.pdf?index=true
- http://naremijex.epizy.com/wuvegati.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fec6.binafa3563df1975faa20a9f40a1306b2262e7fd4338e3a2fc4fba9c52e4dfc9e5c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEC6 | 5472 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.