MALICIOUS
192
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains embedded links pointing to known malicious redirector infrastructure, specifically 'https://yafferge.ru/123?utm_term=job+activity+log+template'. Heuristics indicate it's a link farm on disposable hosting, and ML classifiers strongly flagged it as malicious. The ClamAV detection further supports its malicious nature, identifying it as 'Pdf.Phishing.Trojan-d2568dad23a94d95'. The document body, though heavily obfuscated, suggests a lure related to job activity logs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/123?utm_term=job+activity+log+template In PDF document text
- https://cdn-cms.f-static.net/uploads/4472481/normal_604e64d337e82.pdfIn PDF document text
- https://cdn.sqhk.co/situdejoj/gejg3if/hatch_act_social_media_guidelines.pdfIn PDF document text
- http://xexapitanegis.getenjoyment.net/animal_kingdom_florida_map.pdfIn PDF document text
- https://cdn.sqhk.co/lunilageruvu/SBPjdWM/belanom.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445324/normal_5fdae56b92d08.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425910/normal_605ace3936e45.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462694/normal_60156801b6481.pdfIn PDF document text
- https://cdn.sqhk.co/perolurowona/lshiGia/midimanagebasat.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4455672/normal_60004a271cd99.pdfIn PDF document text
- http://ziviludemedo.iblogger.org/xenevuponakuxosare.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b7e3b1ad-0232-41e1-ae31-3e4799e90d2d/que_es_un_titulo_ejecutivo_arba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c83ace96-a2df-4d3f-bb51-8de4a0d31aab/48450571629.pdfIn PDF document text
- http://newepizudef.atwebpages.com/wordly_wise_3000_book_7_lesson_6.pdfIn PDF document text
- http://golunelew.epizy.com/corsair_k95_platinum_drivers.pdfIn PDF document text
- http://pevipitoz.atwebpages.com/49100753227.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ede3f26c-84f2-4872-9413-96a574132370/principles_dalio_quotes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/079a5ed7-e94d-4bf5-a053-b36efd8500c9/linear_function_word_problems_with_solution.pdfIn PDF document text
- http://sawurawefivovo.myartsonline.com/calaveras_para_pintar.pdfIn PDF document text
- http://mepumubim.rf.gd/dd_4e_monster_manual_2.pdfIn PDF document text
- http://sovogezo.atwebpages.com/lg_bluetooth_headphones_manual.pdfIn PDF document text
- http://safuzidavoje.rf.gd/vlookup_in_google_sheets_not_working.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed33.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED33 | 5268 bytes |
SHA-256: d324ef41512a63c28519266ee41600d19cd565db245ac8e371abbb735963d74e |
|||
font_01_sfnt_off0000ff27.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF27 | 11208 bytes |
SHA-256: 2a8f5984fc3fbf7f841fb060ebf09ec99868de7df3be881acb9db4c89cf467cc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.