MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs, including one that points to 'gimoguvi.ru', suggesting a phishing or content-luring attack. The PDF's structure and embedded links indicate it's designed to redirect users to potentially harmful websites, aligning with spearphishing tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/award?keyword=human+body+systems+quiz+pdf PDF link annotation
- http://deladinabixek.sportsontheweb.net/11105470734.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477173/normal_602727c8dd45c.pdfIn PDF document text
- http://bekopomulasebi.getenjoyment.net/delonghi_portable_air_conditioner_pinguino_pac_n120.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453129/normal_6042a782d3ef8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480579/normal_5fe6baf765e09.pdfIn PDF document text
- http://koxelovanalimu.getenjoyment.net/xelakuzasezaxujenobujij.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f7704f4b-e632-41f9-a9c2-afce73040f3f/37296793133.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab4fe80b-b2a8-4a12-9375-ea078505ea28/tegil.pdfIn PDF document text
- https://s3.amazonaws.com/sepovutapakogaf/define_phantom_power.pdfIn PDF document text
- http://goxafebo.myartsonline.com/74000751100.pdfIn PDF document text
- http://gototura.myartsonline.com/introduction_to_automata_theory_languages_and_computation_1979.pdfIn PDF document text
- https://s3.amazonaws.com/zesixefe/in_tray_exercise_questions_and_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/63f52c1c-d6c7-41b5-bacc-d5cf7aa88439/38243815251.pdfIn PDF document text
- http://karadefega.epizy.com/ceo_bihar_voter_list_2020_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/78424d9e-7d85-4985-b7ba-4e06dc702b87/taco_bell_double_chalupa_box_calories.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7cc926a-6ec6-4edc-a28a-9dc544c26d1b/clasificacin_de_los_derechos_humanos_por_generaciones.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66ca46eb-e65b-4d9d-b6f6-b05dd033bbca/12616935566.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3bcc4a8d-a994-4f83-8756-d8bc8ab2ca7b/dakes_annotated_reference_bible_app.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ee2017f-581a-4834-ba24-190db977e5fb/subakadexibitibe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5e647d2-d076-4017-af6a-a95979119d11/study_bible_for_pc_free_download.pdfIn PDF document text
- http://vezonufibil.epizy.com/what_if_you_tie_the_dealer_in_blackjack.pdfIn PDF document text
- https://s3.amazonaws.com/nodetuxapabara/international_business_contract_template.pdfIn PDF document text
- https://s3.amazonaws.com/sojenozap/datefejaxejab.pdfIn PDF document text
- https://s3.amazonaws.com/murudute/48885524092.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e813.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE813 | 5440 bytes |
SHA-256: c3c14508dce0b2f45202b98aa389b1b6fccda76ac22c9380f829e3569829e86a |
|||
font_01_sfnt_off0000fa81.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA81 | 11128 bytes |
SHA-256: 77c98988f2a5cbc9ed8471b4b67e40cf54390fd130d394c31727efcec9bcea9a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.