MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains multiple embedded URLs, with a high-confidence ML classifier and ClamAV detection indicating malicious intent. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests the document is part of a link farm designed to obscure malicious destinations. The primary malicious URL identified is https://midufefew.ru/strik, which is likely used to serve a second-stage payload or conduct phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=fundamentals+of+heat+and+mass+transfer+8th+edition+chegg PDF link annotation
- https://rorezumi.weebly.com/uploads/1/3/4/5/134591247/xivod_janujupagoguron_xivesegokuxemu_mujixufomozozo.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464715/normal_5fca0c021af68.pdfIn PDF document text
- https://cdn.sqhk.co/gebemiwisero/EpigjM3/rotator_cuff_muscles_insertion_and_origin.pdfIn PDF document text
- https://cdn.sqhk.co/nawamuzimosu/v4jahaH/citation_format_for_science.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384028/normal_6013ba091774a.pdfIn PDF document text
- https://taralibupub.weebly.com/uploads/1/3/4/3/134372711/7bea620507e.pdfIn PDF document text
- https://dejuxowiku.weebly.com/uploads/1/3/0/7/130738850/donututekuzalox_kigedunavaxemoj_sapiwagifon.pdfIn PDF document text
- https://duwawituku.weebly.com/uploads/1/3/4/3/134306950/nusuxa.pdfIn PDF document text
- http://alcozerox.com/822925731657vate.pdfIn PDF document text
- http://letnesil.xyz/how_to_charge_a_stanley_portable_power_station4ppfj.pdfIn PDF document text
- https://cdn.sqhk.co/bewiviki/hfYpzzA/lemedikufuzababodeve.pdfIn PDF document text
- https://cdn.sqhk.co/lebudawojafi/BAijgd8/super_ninjas_movie.pdfIn PDF document text
- http://1xbet-registr.site/einaudi_sheet_music_una_mattinaz9nva.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456143/normal_5fd8be1ea0d4b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461204/normal_6029398ed0f4a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501383/normal_6028232a1cfd2.pdfIn PDF document text
- http://indital.space/9015212856686v9x.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/69b159d9-cce4-40fb-bf2c-f7103b9fefb5/ms_word_table_of_contents_not_updating.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca34b6ef-6bc0-4c6b-895e-8af7b2a438e3/38388116297.pdfIn PDF document text
- https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_b52bcb5b283f4e28a3ffb96d1a8eb65a.pdf?index=trueIn PDF document text
- https://8fc1c2d6-49ba-4d63-8b95-0327ef2b1627.filesusr.com/ugd/1849a1_3f4187a6ceb84df28ef2ec8ad4cb67da.pdf?index=trueIn PDF document text
- https://45dcde1a-aed5-4138-b95e-a0f768a283bf.filesusr.com/ugd/89441e_f5a13c6ca5cc4a1f8667defd8bd7aa70.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6a12ede9-e89a-4bee-88d3-4879b8facc1d/how_to_winterize_a_briggs_and_stratton_pressure_washer.pdfIn PDF document text
- https://be56f97b-0727-4a8e-a141-4155b83e75ac.filesusr.com/ugd/5034d0_d30c8f19ee344c93a39fc110cc67c620.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb90.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB90 | 5584 bytes |
SHA-256: a9294b32f24f3c263dd385c04052cde98673498795c4e86110cd64eb6fcfc80a |
|||
font_01_sfnt_off0000fe64.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE64 | 12028 bytes |
SHA-256: f277917303ef5d8fa3c531ca17c0cd12caccf7e4e8db1d27bac064789cd515b7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.