MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by multiple heuristics as malicious, including a critical finding for brand-impersonation credential phishing. The ML classifier output of 0.999712 and ClamAV detection further support its malicious nature. The document contains a link farm and an embedded URL, with one critical finding pointing to a redirector URL associated with a Chase phishing lure. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to lure users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://tawusizigegik.weebly.com/uploads/1/3/3/9/133997505/milubevugojabor_xavibipobizigi_bukavubosigokox_lusinanomune.pdf.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=a+raisin+in+the+sun+act+2+scene+1+and+2+summary PDF link annotation
- https://cdn.sqhk.co/tekixonef/feghigd/nomezibe.pdfIn PDF document text
- https://tawusizigegik.weebly.com/uploads/1/3/3/9/133997505/milubevugojabor_xavibipobizigi_bukavubosigokox_lusinanomune.pdfIn PDF document text
- https://cdn.sqhk.co/tinipuded/fOhjwji/99017154958.pdfIn PDF document text
- https://cdn.sqhk.co/wojipezusax/gcghgZz/soxok.pdfIn PDF document text
- https://cdn.sqhk.co/busoleva/0aib7ii/planet_der_affen_survival_besetzung.pdfIn PDF document text
- https://korenumotijele.weebly.com/uploads/1/3/4/6/134687452/1546596.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dugibabafod/beautiful_wallpaper_images_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e17c3c7-4897-4894-bb2a-5b18913dcb20/vegawopefejijesuludob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbb53ec2-327b-4fc9-bf8e-a4ebb7dcd835/31365361693.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec897be5-b970-4f6c-bae3-eb4e01fdcad4/rodosazegosilerojidod.pdfIn PDF document text
- https://s3.amazonaws.com/bajapovogam/biodynamic_compost.pdfIn PDF document text
- https://s3.amazonaws.com/purixifusipelid/34256772061.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5221673-c29e-4b20-b01a-a411f1a6193c/83248281815.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1741c8da-2e82-41fa-ad61-72cfc3d99c02/restaurants_near_walt_whitman_mall_huntington_ny.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fcd03829-b1c3-4352-96a1-a117fda985db/double_down_blackjack_split.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d33ae3cd-066c-4048-b5c4-71742556388c/ferefos.pdfIn PDF document text
- https://s3.amazonaws.com/wixanarer/73535855207.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e36fe30-1c9c-43de-92d8-3a6dbb0e6c48/qu_enfermedad_es_la_que_se_queda_dormido_de_repente.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/52f3c39c-7d95-4e5e-a683-337a5b01e315/it_will_be_fine_meaning_in_urdu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/56293d9b-2b1f-448c-9514-e80fca354979/electrical_engineering_jobs_in_dubai_for_fresh_graduates.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5fcfc0a5-9359-4058-a295-6f9888b0ef56/nurarijax.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa9e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA9E | 5424 bytes |
SHA-256: e6968f339666bf492278d6fd6b409e1824de95c01024cce98e73ca59668e773f |
|||
font_01_sfnt_off00010ceb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CEB | 10936 bytes |
SHA-256: d7410cd2cc1f49d7c13126b8bfa583e53bb58aef82bc1b7aba41e3ef7a37eab3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.