MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/123?utm_term=amenaza+de+parto+pretermino+oms+pdf'. This indicates the document's primary purpose is to redirect users to a malicious site. The ML classifier and ClamAV detection further support its malicious nature, classifying it as a phishing or trojan PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/123?utm_term=amenaza+de+parto+pretermino+oms+pdf In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/cc52815d-df6c-49bb-b32c-4e00fe4a01d0/mother_night_kurt_vonnegut_audiobook.pdfIn PDF document text
- http://sonubugu.pbworks.com/f/how_to_install_mods_on_ps4_gta_5.pdfIn PDF document text
- http://nosiravuga.pbworks.com/w/file/fetch/144796131/do_mini_air_conditioners_work.pdfIn PDF document text
- http://nefusim.pbworks.com/f/52615830607.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4930ef6e-86fb-40b2-9946-236536b163db/java_jdk_8_download_64_bit_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53dc2a2c-2c2c-4ca4-9223-2ec68fd09276/nagoxawegodupalatu.pdfIn PDF document text
- http://gatunam.pbworks.com/f/11232485989.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30356b03-c5dc-4f98-bc98-3e97c7d7ed0b/venufixune.pdfIn PDF document text
- http://dumajimov.pbworks.com/f/ssc_english_1st_paper_question_2019_dhaka_board.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad27c04a-322e-4075-ad4b-16c5c9849dde/77558924432.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c6936d5-ca22-4ec1-986e-356d4ee23a1a/fafokukugogidumewipuwi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/783ac644-b294-4ef3-8cbd-d16bc1c17794/keurig_2.0_k300_problems.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9674c191-e095-44af-88a2-468f217fa1e7/15527568809.pdfIn PDF document text
- http://pisaxolakek.pbworks.com/f/eliphas_levi_libros.pdfIn PDF document text
- http://katafuzum.pbworks.com/f/simodalososijujujozib.pdfIn PDF document text
- http://xojifot.pbworks.com/w/file/fetch/145224516/watch_filmy_bollywood_movies_2020.pdfIn PDF document text
- http://jevibufile.pbworks.com/w/file/fetch/145210764/wovigezixafusu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f23aff8-81e9-4943-b1aa-f6f209a41548/virginia_woolf_moments_of_being_quotes.pdfIn PDF document text
- http://fajopab.pbworks.com/w/file/fetch/144549651/kuvabasafiw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3caf3d3c-3a36-4b18-ae03-3d02c6e5cc2e/how_to_fill_up_pf_withdrawal_form_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8793783e-3961-4c41-be4a-688f19e79290/how_to_use_gopro_8_black_as_webcam.pdfIn PDF document text
- http://negovijalulu.pbworks.com/w/file/fetch/144412662/54241097393.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f924.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF924 | 5196 bytes |
SHA-256: 6f388f83316ef3c7eed82c8d05286ddfab2a92d051afbfaf1dd09e32de406c0f |
|||
font_01_sfnt_off00010abc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ABC | 11372 bytes |
SHA-256: 845b40412b9245c6870752a7a7bac01133016fe102db2d5f729dba905c604e61 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.