MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains heuristics indicating it's a phishing lure, specifically using an image to redirect users to a malicious URL. The embedded URL, https://pelibifir.ru/123?utm_term=letter+of+complaint+template+workplace+bullying, is flagged as a redirector for free-download phishing. While no scripts were explicitly extracted, the ML classifier and ClamAV detection strongly suggest malicious intent, likely related to distributing further payloads or conducting phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/123?utm_term=letter+of+complaint+template+workplace+bullying PDF link annotation
- https://cdn-cms.f-static.net/uploads/4422659/normal_605811d93ab1a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4379236/normal_5ffa0c50ea4b0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4526930/normal_600f60610850f.pdfIn PDF document text
- http://wiwajekirutiw.scienceontheweb.net/3071484094.pdfIn PDF document text
- http://gikepofazanapol.mypressonline.com/25588366824.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466673/normal_6068ef5936c1f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/wonumafubij/2850165057.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9e54f79-181f-4e79-8e74-15950bd5031d/sikegisegineb.pdfIn PDF document text
- https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_cb7ae258b9cc416e8feb50a8c2bcffa2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xaliwalufoguni/vexuduxafapifaroveb.pdfIn PDF document text
- https://de74b992-0de1-402f-a2cc-438209b178b2.filesusr.com/ugd/2693ef_6e5664031d214c2db69c534217316f0c.pdf?index=trueIn PDF document text
- http://mifotabelimudon.myartsonline.com/domogulovezazoxejunimig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72ad52b7-2a58-469c-9f7e-18ed8d8d5e31/razer_ouroboros_instructions.pdfIn PDF document text
- http://zogadawedalifap.onlinewebshop.net/195106643.pdfIn PDF document text
- http://kavibajegis.onlinewebshop.net/excipientes_farmacuticos_e_suas_funes.pdfIn PDF document text
- https://s3.amazonaws.com/dagasopones/sitejav.pdfIn PDF document text
- https://s3.amazonaws.com/jivamubug/ganesh_chaturthi_whatsapp_video_2018.pdfIn PDF document text
- http://nununad.myartsonline.com/wigenobilijiwoniroloxap.pdfIn PDF document text
- https://e791dc30-71fd-4519-a75e-453748eb9c32.filesusr.com/ugd/8a5fcf_4227254731c54a5abc6c13c925595e49.pdf?index=trueIn PDF document text
- https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_ec7d1c3733524ffd82d01d5212757054.pdf?index=trueIn PDF document text
- http://supuwevul.atwebpages.com/the_crown_season_3_cast_queen_elizabeth.pdfIn PDF document text
- https://s3.amazonaws.com/xamibudasagas/answer_to_demand_for_discovery_and_inspection.pdfIn PDF document text
- https://f9c380c0-3c9a-404e-8c76-a924832b335c.filesusr.com/ugd/9c8fb9_45774d1db0b84a309db827f6a1afa86c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/52a76d1a-7045-4626-b1f2-c77322f45627/kaluluzinidet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001219b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1219B | 5496 bytes |
SHA-256: 6b2ee1bbb08532ac001fc9e289ded9090bbaac26a167f69a13a8e575e572edbf |
|||
font_01_sfnt_off0001345d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1345D | 11552 bytes |
SHA-256: 60b0822d4eb1cf76a3926512cf438bbe92f08551aa5905da9061130aef1b3142 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.