MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous external links, with a primary URL leading to a site that appears to be a lure for a search query about gun raffle legality. This suggests a phishing or malware distribution attempt. The presence of ClamAV and ML heuristic firings, along with the PDF_SEO_LINK_FARM detection, strongly indicates malicious intent. No scripts were extracted, but the document's structure and embedded links point towards a social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=are+gun+raffles+legal+in+nc
- https://static.s123-cdn-static.com/uploads/4373520/normal_5fe32fe9de181.pdf
- https://static.s123-cdn-static.com/uploads/4388163/normal_5ff19a7dd8d71.pdf
- https://cdn.sqhk.co/dodamewope/ciefVjh/dotikirujatorenogozeva.pdf
- https://static.s123-cdn-static.com/uploads/4483365/normal_5fcef93008c42.pdf
- https://cdn.sqhk.co/tonufipu/gdrfhaL/hooplife_basketball_academy_little_rock_ar.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://a819be37-316e-4347-83bc-b067fb6953c8.filesusr.com/ugd/d5662a_df70ece5030641999476e42699f1062a.pdf?index=true
- https://uploads.strikinglycdn.com/files/fedbc773-7345-4de6-a730-a67145940dd7/mini_weapons_of_mass_destruction.pdf
- https://uploads.strikinglycdn.com/files/51acd769-7b50-42b0-a658-b875109736d6/43886019219.pdf
- https://uploads.strikinglycdn.com/files/ac949d27-d30f-4b4e-935c-aff9e3f5747d/suzuki_cello_book_10_contents.pdf
- https://uploads.strikinglycdn.com/files/c525c530-b647-482e-9555-eb862b505236/satafidulak.pdf
- https://uploads.strikinglycdn.com/files/d21fee14-63ef-43e4-87fd-6a5200722480/fagasakuwil.pdf
- https://uploads.strikinglycdn.com/files/8cc81b5e-4e2c-4c1b-8d4a-7bfc387a34b5/gozinefus.pdf
- https://uploads.strikinglycdn.com/files/a71e4e09-403e-4f5a-93d8-4522c7f63948/samsung_nx3000_manual.pdf
- https://uploads.strikinglycdn.com/files/d20f0f04-45ed-4de1-a0c0-8e62510da105/mekuxivolawusa.pdf
- https://d190c387-1498-4382-a59e-98d1a0a9794c.filesusr.com/ugd/a91264_1b70241c75a44f28a49a3d852dc49b23.pdf?index=true
- https://uploads.strikinglycdn.com/files/d9b75a43-1aa6-4835-b6ef-bc3b07e46e59/hp_elitebook_2760p_launch_date.pdf
- https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_075aceaa9fcc4a9a8d051e4634bf0a49.pdf?index=true
- https://uploads.strikinglycdn.com/files/36181c38-50f7-42ef-8760-436cba2941c3/20628032884.pdf
- https://uploads.strikinglycdn.com/files/131106cb-ae4d-487a-b6b8-320ca366e5b7/naworimonunizotezukakiv.pdf
- https://uploads.strikinglycdn.com/files/a3dee393-2f56-4e23-825d-652e55712d9f/how_to_reset_a_firex_smoke_detector.pdf
- https://a181bb3e-7445-4f1f-a1cf-b2fe66c13e92.filesusr.com/ugd/91ce54_ba240bb4dcb2440a865ab30b43247e9a.pdf?index=true
- https://uploads.strikinglycdn.com/files/3344840c-b7b9-4ce4-bfcf-4f329f30a504/yoga_workout_for_flexibility_beginners.pdf
- https://uploads.strikinglycdn.com/files/a28e4ac3-c76a-4692-8a6b-e7cd0dd52ecc/14740275171.pdf
- https://uploads.strikinglycdn.com/files/535cb0e8-db98-4691-844f-894ca22c2b22/25831922868.pdf
- https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_ce409685984c497f8c92c66e82f38b04.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f8f9.bin210d81371648bf236a8b01dc8866c1774cb6d1071128c800d6e515ce5e692610 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8F9 | 5036 bytes |
font_01_sfnt_off00010a35.bin509bed5b4e9ee6a73da6a58aa46cb6de0f06c14483fcb7e5c594a2df0430d372 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A35 | 11052 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.