MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document contains a lure related to 'french manicure guide strips' and includes an external URI that redirects to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the embedded URLs suggest a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/wix?keyword=where+to+buy+french+manicure+guide+strips PDF link annotation
- https://cdn.sqhk.co/nowonipewo/hcYAU1p/lego_marvel_super_heroes_2_ps4_walkthrough.pdfIn PDF document text
- https://cdn.sqhk.co/tagodepa/Uqlgijd/dude_perfect_bowling_trick_shots_2.pdfIn PDF document text
- https://cdn.sqhk.co/lumozupa/fShaV3K/coulomb_s_law_experiment.pdfIn PDF document text
- https://cdn.sqhk.co/vabadoma/oShgT3p/41206185445.pdfIn PDF document text
- https://cdn.sqhk.co/begorukenega/Qg84hb7/asalem_gurthukuradhu_video_song.pdfIn PDF document text
- https://cdn.sqhk.co/tumosirewuw/ja1rias/game_hack_speed_hack_game_free_fire.pdfIn PDF document text
- https://cdn.sqhk.co/novitovikor/RvKjenh/the_hangover_cast.pdfIn PDF document text
- https://cdn.sqhk.co/fogobewataja/big3geI/56907797140.pdfIn PDF document text
- https://cdn.sqhk.co/suxugipajepo/jcTmqIG/5240952502.pdfIn PDF document text
- https://cdn.sqhk.co/ravusigi/dsPhahd/51232519365.pdfIn PDF document text
- https://cdn.sqhk.co/ravusigi/aAgedid/6038192321.pdfIn PDF document text
- https://cdn.sqhk.co/dogilijesiwu/ajgZZme/dance_movies_ballet_hip_hop.pdfIn PDF document text
- https://cdn.sqhk.co/zotevokep/icB1RDg/18664914178.pdfIn PDF document text
- http://pinenud.mygamesonline.org/99061642517.pdfIn PDF document text
- http://nepatokada.mypressonline.com/86254678389.pdfIn PDF document text
- http://vesajob.getenjoyment.net/tica_a_nicmaco_aristteles_livro.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8bac4862-af34-4870-bca3-970ef42069f3/19087208597.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90e3b8eb-8bf1-428a-a031-17a8e6f77dde/mororikiv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f0e7a9c-7da2-4717-8e5f-8cee5454dd46/what_is_the_formula_for_a_right_angle_triangle_area.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44e404fd-179f-4c90-9554-5c457694668f/mefobopefoxedesi.pdfIn PDF document text
- http://mizetum.onlinewebshop.net/budumezutola.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d8a7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD8A7 | 5792 bytes |
SHA-256: 07a67373bd2886e52a0d193fecaeda5aeb36506d082eddd13045263d1a32f8a2 |
|||
font_01_sfnt_off0000ec4f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC4F | 11340 bytes |
SHA-256: f73b68ebb6898de41f9c1500a2727e3da4b14cbc552e86716185e75cfeac9c44 |
|||
font_02_sfnt_off0001123f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1123F | 16204 bytes |
SHA-256: a109d5cc1a8599929bd7702a943337bd153faf2776ff4e30ac39a15e38c17cef |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.