MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF contains numerous external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or redirection mechanism. The 'SE_BROWSER_INSTALL_LURE' heuristic indicates the document's content is designed to trick the user into installing something, a common social engineering tactic. The ClamAV detection and ML classifier further support its malicious nature, likely as a phishing or trojan delivery vehicle.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=malayalam+writing+practice+book+pdf
- https://jevuzukolusiwu.weebly.com/uploads/1/3/0/7/130739503/a0cef4a.pdf
- https://cdn-cms.f-static.net/uploads/4405654/normal_606befbc7cf1c.pdf
- https://zuwuwuxi.weebly.com/uploads/1/3/4/8/134883554/9507862.pdf
- https://bategasef.weebly.com/uploads/1/3/2/7/132712490/zijawopogige.pdf
- https://rapekazojeroxe.weebly.com/uploads/1/3/4/6/134697974/180252.pdf
- https://penabapemuzoji.weebly.com/uploads/1/3/1/4/131453208/243b12f5f5fb8.pdf
- https://cdn-cms.f-static.net/uploads/4366375/normal_6046347e91ad8.pdf
- https://cdn-cms.f-static.net/uploads/4501046/normal_5fd82068750c9.pdf
- https://cdn-cms.f-static.net/uploads/4470968/normal_604819db1214d.pdf
- https://toripifisesu.weebly.com/uploads/1/3/4/3/134367164/dujerovovawo.pdf
- https://jujizifij.weebly.com/uploads/1/3/4/3/134309807/kiwev-potufalusakokot.pdf
- https://luvikexixof.weebly.com/uploads/1/3/4/4/134481561/bapalobovebigu_gebapebex.pdf
- https://feverawujebuv.weebly.com/uploads/1/3/5/3/135314909/repemum.pdf
- https://nozezezolakufu.weebly.com/uploads/1/3/2/6/132695232/085291dd58c9c.pdf
- https://cdn-cms.f-static.net/uploads/4387566/normal_603f4a0be360c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/377d71e6-c9bb-442f-b565-e10a4be87edf/7481072245.pdf
- https://uploads.strikinglycdn.com/files/1d005159-181b-470b-8794-e6f34f2e7dd8/barrons_toefl_essay.pdf
- https://uploads.strikinglycdn.com/files/a29e0fea-2a37-469c-a7d3-6746114e10d4/patebezuwogisezosimomuxa.pdf
- https://uploads.strikinglycdn.com/files/2f9b9f5d-b9c0-4a1f-b590-063dd9073a53/maze_runner_death_cure_book_short_summary.pdf
- https://uploads.strikinglycdn.com/files/3384d2e8-7bc1-4f8e-baa9-d5d69d09fc96/keurig_2.0_filter_change_youtube.pdf
- https://uploads.strikinglycdn.com/files/2505c5c9-4266-4ba2-894f-60c6af48e85c/how_to_use_clear_vinyl_transfer_tape.pdf
- https://uploads.strikinglycdn.com/files/a6e3334b-dd60-48f3-9c3d-6ed737f6d934/maytag_centennial_commercial_technology_washer_lid_lock_bypass.pdf
- https://uploads.strikinglycdn.com/files/fd18a454-0a7f-44a1-a864-5398e2742da7/law_of_torts_notes_in_kannada.pdf
- https://uploads.strikinglycdn.com/files/9febcd26-86a4-485b-a7d4-54e914a3da16/92053472683.pdf
- https://uploads.strikinglycdn.com/files/063ddc10-c67d-4e88-b96f-6d95087dcb6b/rofobovusivaku.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011484.bin267f291b70f17dd2709eaf2cf1ecf375321728493f6b733eb8cb8a2de90a5b98 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11484 | 5488 bytes |
font_01_sfnt_off00012725.bin13c75df66e8b51a932dbb929e786b5722e3c19657cf62ef2b0f9f99e59443ed2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12725 | 10728 bytes |
font_02_sfnt_off00014be4.bin1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14BE4 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.