MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable or suspicious domains, suggesting a link farm or redirection mechanism. The PDF structure and embedded links indicate an attempt to direct users to potentially malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.8203
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/award?keyword=tamuk+electrical+engineering+degree+plan PDF link annotation
- https://cdn-cms.f-static.net/uploads/4406170/normal_5fdada4bc7cf5.pdfIn PDF document text
- http://dujalubudekir.22web.org/professional_curriculum_vitae_powerpoint_template.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417675/normal_5fcc68d22f8f3.pdfIn PDF document text
- http://zekaxezixil.medianewsonline.com/tezorakafazit.pdfIn PDF document text
- http://fredo.bike/nanosofebq5rzn.pdfIn PDF document text
- http://brumbum6.xyz/what_does_it_mean_when_your_car_says_service_airbag_systemacjrf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455669/normal_60210be422fe5.pdfIn PDF document text
- http://bisibometixo.mywebcommunity.org/are_tax_rates_changing_in_2021.pdfIn PDF document text
- http://seamanygau.best/642687267745ica3.pdfIn PDF document text
- http://ziwusis.getenjoyment.net/pesanuzibijixenidajubiso.pdfIn PDF document text
- http://ing-jobs-opportunities.com/washington_dc_weather_today_and_tomorrow51ypz.pdfIn PDF document text
- https://3f9320ff-391d-49df-b192-c557e211a93c.filesusr.com/ugd/469aea_c01cfc8ccd1d45beaae123ae975dcc14.pdf?index=trueIn PDF document text
- https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_83aad3e521de4779b96b821e2c55982b.pdf?index=trueIn PDF document text
- https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_615ecbfa9f384228a4de6c826b2e5a1f.pdf?index=trueIn PDF document text
- http://jidabalelibixu.rf.gd/84463269191.pdfIn PDF document text
- http://lumosaneja.onlinewebshop.net/bollinger_bands_trading_strategies_that_work.pdfIn PDF document text
- https://8d684a1e-4078-49cd-b336-05adf09473b6.filesusr.com/ugd/2b25e8_917c796b65d94788acfadfa1c081fcd4.pdf?index=trueIn PDF document text
- https://44034db3-6cdd-4729-adf3-7ccd6afcf354.filesusr.com/ugd/9fe9cc_9e231a68a2804d838f6f313a3726d0e5.pdf?index=trueIn PDF document text
- https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_99de6c7847bf41ef826dea7e2fd135e4.pdf?index=trueIn PDF document text
- http://pulutugorivexek.atwebpages.com/att_-_crl32102_dect_6.0_expandable_cordless_phone_with_digital_answering_system.pdfIn PDF document text
- https://aca292c6-a3ee-4c96-b4c9-db15c8eca1b9.filesusr.com/ugd/cd1d52_4d89a44d4d8640d99563016c79cde034.pdf?index=trueIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.