MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains numerous links to external websites, many of which are hosted on disposable domains and appear to be part of a link farm. One prominent URL, 'https://archism.ru/uplcv?utm_term=gun+game+download+3d', suggests a lure for downloading a game. The ML classifier and ClamAV detection indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.6693
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://archism.ru/uplcv?utm_term=gun+game+download+3d
- http://keitbg.com/images/files/57053195219.pdf
- http://morethancars.nl/uploads/edytor/file/kubeked.pdf
- http://ngocphuocjsc.com/public/default/ckeditor/files/kavofutafujebof.pdf
- http://jplus-ag.com/upload/files/BodyFile__61354500A0400.pdf
- http://22vek-omsk.ru/fck_editor_files/files/xevekatojowutanoviduk.pdf
- https://tcremich.lu/files/files/168693245.pdf
- http://www.impactit.in/ckfinder/userfiles/files/58368154162.pdf
- http://pathtojanna.com/userfiles/files/xibiloleli.pdf
- http://opusbiz.kr/data/editor/file/1979030969614a1c9912612.pdf
- http://ettermanenterprises.com/ckfinder/userfiles/files/82531451356.pdf
- http://futimisdev.com/userfiles/file/sitikujufafu.pdf
- https://thietbivesinhanhhuy.com/asset/files/49942105278.pdf
- http://cnkls.com/userfiles/file/1631845521.pdf
- http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/a5hsktn5tr90cdq6veh46bvs30/1136401725.pdf
- https://worldpigment.com/image/upload/File/kowawugiwosutovolexipawax.pdf
- http://toitureetfacade.fr/data/Files/62151468589.pdf
- http://svadbavmoskve.com/content/xuploadimages/file/13835618736.pdf
- https://brakos.it/file/72570867835.pdf
- https://equalitas.es/userfiles/file/71953733506.pdf
- https://worldpigment.com/image/upload/File/11552898587.pdf
- https://dursunguney.com/userfiles/files/15663991926.pdf
- https://karjerastests.bankai.lv/ckfinder/userfiles/files/77438845823.pdf
- http://fmmvn.net/userfiles/files/18946686583.pdf
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa23.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA23 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.