MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic firings reveal a PDF containing a large number of external links, suggesting a link farm or phishing lure. The primary malicious URL identified is https://pelibifir.ru/123?utm_term=d%2526d+basic+set+rulebook+pdf, which is likely used to redirect users to malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9909
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/123?utm_term=d%2526d+basic+set+rulebook+pdf
- http://gexopidikimo.mygamesonline.org/noperodegasivimanikon.pdf
- https://cdn.sqhk.co/loxexafetivu/axjaidC/kimuze.pdf
- https://cdn-cms.f-static.net/uploads/4481173/normal_602d6048aca5d.pdf
- https://cdn.sqhk.co/dinigivo/c1jfgeK/ion_party_rocker_live_speaker.pdf
- https://cdn.sqhk.co/pixazizaze/irhiFgn/free_offline_games_for_iphone_4s.pdf
- http://nogurufegu.mygamesonline.org/giruxigijofuvezupinitenex.pdf
- https://cdn.sqhk.co/nazopekujavi/UA6emiC/shake_shack_promo_code_online.pdf
- https://cdn.sqhk.co/nowagenika/jcgHXJp/72189890761.pdf
- https://static.s123-cdn-static.com/uploads/4385028/normal_5feb960539d23.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://9c68190f-8328-4368-8349-889d122a119f.filesusr.com/ugd/c4dbd3_f28c1a0cebf4425abab80f132d9df76c.pdf?index=true
- https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_ccb93865193547b38e8ddaf1fd59bff3.pdf?index=true
- https://da18e6a8-d720-42de-a88c-3f13daad7efb.filesusr.com/ugd/08fe48_cc7b4e7747fb4e25a5eda7eac13adb3d.pdf?index=true
- https://9a4203bb-6ff2-4ef1-9c63-3f113f84a884.filesusr.com/ugd/ea9bdf_6d6eb6919bd64330a92295a75842afca.pdf?index=true
- http://vorisenunajix.myartsonline.com/lexus_rx_350_suv_2019_price.pdf
- https://5663e088-3595-439c-971a-5873693bee35.filesusr.com/ugd/e98895_eee2bd6513804c7c9dfddcad52a72381.pdf?index=true
- https://e6676b24-921d-4f57-8fca-beda98688f3c.filesusr.com/ugd/144d27_9b91a407fce945c4b424d3e735e4a513.pdf?index=true
- https://49b821e7-ee7e-41b4-809b-d0417b8c1ddf.filesusr.com/ugd/927743_39b3b933c8d042439a42d76b0456d8c2.pdf?index=true
- https://ad323f3e-245e-4e3c-8b16-de91fefec063.filesusr.com/ugd/5ea691_a8336e66ab2c4e47a5624645e6ff3996.pdf?index=true
- http://bilisedutave.myartsonline.com/how_to_hook_up_rca_home_theater_system.pdf
- https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_dc564eabee5f4d7c808951274e4809a5.pdf?index=true
- https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_e378314f819c4035ae321e0ab0f55a82.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off00016f4a.bin86080a04ebd78c763bf26cb6368b1a231e23f9dd80b9fbcaa967b2208a50f933 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x16F4A | 6504 bytes |
font_00_sfnt_off0000deaf.bin696a81e84d583080892157656baf155fffa2942e40915b42bf972e5d124c7400 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDEAF | 7516 bytes |
font_01_sfnt_off0000f234.bina5b279f02d72b9a9f90a20f4d0ea34bc529691a211e0332fc8c824e18e1de280 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF234 | 3148 bytes |
font_02_sfnt_off0000fd73.binb6bc3e761eca8ae26333d0367913862b9788f7109bed8a3dd2635371d897bba1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD73 | 3484 bytes |
font_03_sfnt_off0001089f.bin06620024b44374a83b8c1884f59b4bec392d08253552662d24842b9828248703 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1089F | 6280 bytes |
font_04_sfnt_off0001180a.bindda5c22d5d85bd3bf3e21df3b10691b53dff3807276e54bf80bebd5a50a10454 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1180A | 17260 bytes |
font_05_sfnt_off00014ae7.bin704e4f2605e0eaf15293b796e295765bb4019acaac2a5e915369f48b59420b95 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14AE7 | 16516 bytes |
font_06_sfnt_off00016188.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16188 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.