MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, a common tactic for SEO poisoning or phishing campaigns. The primary URL, 'https://gimoguvi.ru/strik?utm_term=diary+of+a+wimpy+kid+the+meltdown+pdf+free+online', suggests a lure to download content related to a popular book, likely to mask malicious intent. ClamAV detection and ML classification strongly indicate maliciousness, pointing towards a phishing or trojan distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/strik?utm_term=diary+of+a+wimpy+kid+the+meltdown+pdf+free+online
- https://cdn-cms.f-static.net/uploads/4448345/normal_604f14ddb286c.pdf
- https://jadibezunapav.weebly.com/uploads/1/3/4/6/134610372/fda2b01f4.pdf
- https://kumapeforurimo.weebly.com/uploads/1/3/4/6/134664671/9126168.pdf
- https://nilarekatopa.weebly.com/uploads/1/3/1/1/131163832/mupesesobus.pdf
- https://figiroxofidun.weebly.com/uploads/1/3/0/7/130740151/bemuritenage.pdf
- https://jorikune.weebly.com/uploads/1/3/4/3/134371696/dipemeg_vikuvafe_zadifiwikofaz.pdf
- https://gorenusedom.weebly.com/uploads/1/3/5/3/135326887/3591153.pdf
- https://static.s123-cdn-static.com/uploads/4368485/normal_5fcdb832e216c.pdf
- https://cdn-cms.f-static.net/uploads/4484370/normal_603604e7e78dc.pdf
- https://liganori.weebly.com/uploads/1/3/1/6/131637073/e3f76c0d.pdf
- https://sajesugepila.weebly.com/uploads/1/3/4/4/134467456/biruvajixuzazixik.pdf
- https://cdn-cms.f-static.net/uploads/4454999/normal_5fd81168d819f.pdf
- https://cdn-cms.f-static.net/uploads/4447101/normal_5fd2ee9a96841.pdf
- https://jorazejub.weebly.com/uploads/1/3/2/6/132695428/zusixuxenu.pdf
- https://vudewozojaw.weebly.com/uploads/1/3/6/0/136053158/3171900c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f7f72251-15f9-4b6c-b9cc-6d0cde42b20c/karcher_pressure_washer_surface_cleaner.pdf
- https://uploads.strikinglycdn.com/files/f4e2bb13-31ba-4668-bb91-61b12b3c92e4/panasonic_inverter_microwave_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/e22ae915-048b-4e1e-9e1d-6be2757a5db1/80354351077.pdf
- https://uploads.strikinglycdn.com/files/faaf1f43-87d8-44c0-9b34-700c39215b92/10502291384.pdf
- https://uploads.strikinglycdn.com/files/2acfc217-97a8-447b-be77-9f08da4f790c/how_to_write_a_soap_note.pdf
- https://uploads.strikinglycdn.com/files/a011bece-cd23-45e8-9184-1ac4d7dd3fd1/breakfast_at_tiffanys_full_movie_free_youtube.pdf
- https://uploads.strikinglycdn.com/files/a43fd786-7a92-4a4e-affa-0de753e0c62e/how_long_to_file_a_claim_usps.pdf
- https://uploads.strikinglycdn.com/files/e2f81e84-89d9-4b3f-8842-92ee5f6f00a7/93821472426.pdf
- https://uploads.strikinglycdn.com/files/2aeda261-a4e4-4b3d-aa4e-ec55565ec69e/daneligoko.pdf
- https://uploads.strikinglycdn.com/files/246a0395-ff03-4313-8569-4a570d2895e8/rapugubabowotala.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015486.bin94ca44d84375536b16b0d932954e2c7c71cbb1477c35110c9bb140ce016c6c51 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15486 | 5360 bytes |
font_01_sfnt_off000166b9.bin502aab71362f4974f47437485d3de2fbd8af56a8c813069ac54e3c8f9c425a73 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x166B9 | 11960 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.