MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a technique often used in link farm attacks or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to a game, likely to entice clicks on the embedded malicious URLs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=how+to+change+kit+in+dream+league+soccer+2019 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4411245/normal_6005087355743.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450516/normal_6033519cc99a1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4377098/normal_606a21a9f2158.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369514/normal_5fe5dfc3b2d37.pdfIn PDF document text
- https://zubisixoligifi.weebly.com/uploads/1/3/4/4/134479514/8085065.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495037/normal_603e0e33b3f3f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485299/normal_6015414b5c7a0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376086/normal_601e53486bdd8.pdfIn PDF document text
- https://sagojuxejuzogug.weebly.com/uploads/1/3/4/5/134598596/352c04f768cdd7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4401711/normal_602534399f160.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4385410/normal_5ff56aaac69a6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4447089/normal_60140eac2f75b.pdfIn PDF document text
- https://mojipidu.weebly.com/uploads/1/3/4/3/134391160/4324618.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417423/normal_60434cd1b91f1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/140e7a50-0a2b-44d5-bcb3-ac05d154cf6b/pokemon_handbook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5d8a5dd-c397-4391-91bd-e32086b5cae8/17197308239.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45e9f9e0-9dca-4dfd-a231-16de8c5672f6/nist_cloud_computing_definition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7d7ae80-d285-4a45-b80e-30c8e6d4bff3/database_security_policy_rules_and_regulations.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9cf41e51-8309-4518-85c3-c6ee84d7abd5/acer_aspire_5750_touchpad_driver_windows_10.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d7fc3bf-89a2-40e8-8d11-3b9da0145f53/37054455167.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/969a7a49-2ac0-4c28-91d6-4fecfb73b9a8/traductor_ingles_espaol_google_translate.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d74ea0dd-d53f-4770-a573-e1ba47214092/koxuzakuvubusama.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cf615689-0b13-494e-9bb2-e5cd6dd88e7b/31685907628.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001104d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1104D | 6744 bytes |
SHA-256: b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808 |
|||
font_01_sfnt_off00012132.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12132 | 5952 bytes |
SHA-256: c28ac19886ec32d60baa56bdc84d8fb31ada9ab2c45e684d8057c622ff73f8b5 |
|||
font_02_sfnt_off0001355f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1355F | 13452 bytes |
SHA-256: 3993f53881359870c6a6e9078fea0e666e9dcccb1a60ce9f461935f657772638 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.