MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One of the primary links, 'https://crysiq.ru/pbw?utm_term=how+to+adjust+square+d+pumptrol+pressure+switch', is directly embedded and likely leads to malicious content or phishing pages. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9785
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crysiq.ru/pbw?utm_term=how+to+adjust+square+d+pumptrol+pressure+switch
- https://cdn-cms.f-static.net/uploads/4467005/normal_60b7a09a781b6.pdf
- https://cdn-cms.f-static.net/uploads/4375503/normal_6068d039d877b.pdf
- https://jafusakivamo.weebly.com/uploads/1/3/0/7/130739280/zakubuzolibe-gijanev.pdf
- https://cdn-cms.f-static.net/uploads/4444102/normal_5fd2ca2a7821a.pdf
- https://cdn-cms.f-static.net/uploads/4458631/normal_603ab08f895fa.pdf
- https://dibikavo.weebly.com/uploads/1/3/0/7/130738915/a0b05997f91b63.pdf
- https://static.s123-cdn-static.com/uploads/4491705/normal_5ff30ce0dfa65.pdf
- https://cdn-cms.f-static.net/uploads/4387036/normal_6052523969510.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/5f09e97e-da6a-4588-893b-10e420485fc6/90037108227.pdf
- https://uploads.strikinglycdn.com/files/e2b51036-9fda-4d0c-8b66-d599bdfd3afe/girl_with_the_dragon_tattoo_movie_cast_2009.pdf
- https://uploads.strikinglycdn.com/files/448d3fdc-0fb2-41f2-949b-53fdbf00acf8/6534315485.pdf
- http://pivumiraw.pbworks.com/w/file/fetch/144837579/29576052456.pdf
- https://uploads.strikinglycdn.com/files/f01d999f-adfa-4af4-9336-cdee09d68bdb/nancy_drew_and_the_hidden_staircase_movie_trailer.pdf
- https://uploads.strikinglycdn.com/files/4b9d6460-d556-4960-87d8-6c4f58dfde1c/what_is_critical_thinking_in_education.pdf
- http://zopujoxobug.pbworks.com/w/file/fetch/144411489/how_to_move_an_elliptical_up_stairs.pdf
- https://uploads.strikinglycdn.com/files/a35fdbf1-e5e5-409f-a33e-5b7edd7de380/how_to_get_rid_of_pattern_day_trader_robinhood.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dd6b.bind824e7c7e194e15c931509a463e710c97c4b93a0bba3a3f6c1632b34c44446ea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD6B | 5568 bytes |
font_01_sfnt_off0000f040.bin4feb89b1cc081d4f3c8f13e66e892ee7246bb8216ade5a753755bc0e8cf4945e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF040 | 10196 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.