MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains multiple external URIs, with one prominent URL pointing to 'seumenha.ru' disguised as a search result for sheet music. The PDF's structure and embedded links suggest it's designed to redirect users to potentially malicious content, aligning with phishing or malware delivery tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9964
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/123?utm_term=godfather+theme+song+sheet+music+violin PDF link annotation
- http://rudovatimokasum.medianewsonline.com/cambridge_advanced_learner_s_dictionary_5th_edition.pdfIn PDF document text
- http://puvepum.getenjoyment.net/logical_reasoning_questions_download.pdfIn PDF document text
- http://powajaxib.medianewsonline.com/fepuni.pdfIn PDF document text
- http://nepatokada.mypressonline.com/24009894646.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387565/normal_60148d7d7546a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381962/normal_6037e5a14242e.pdfIn PDF document text
- http://retapadu.medianewsonline.com/suregopexemoxota.pdfIn PDF document text
- http://bobujopolodusol.mygamesonline.org/business_english_book_free_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4467278/normal_60166511e36e9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4474739/normal_6041416ea4d6f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388060/normal_5fd3b35ddcf3f.pdfIn PDF document text
- http://tefuvawilutir.mypressonline.com/air_conditioner_cycle_diagram.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_aecf8b14ebe14cb5ae96d8ab3e86db8c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/103ead43-16aa-46f1-bc9f-6345fec43f4a/asus_rt-n66u_wireless_speed.pdfIn PDF document text
- https://5c71d6b4-13b5-43a2-97a4-9a0eba4d0f4d.filesusr.com/ugd/0f1814_6c78ba0229fd4d9e9cd3d1c7a6a03368.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kodipopujufipig/why_did_grandma_got_run_over_by_a_reindeer.pdfIn PDF document text
- http://gupatevefojip.myartsonline.com/pawexufaz.pdfIn PDF document text
- https://s3.amazonaws.com/magapeguwabe/sotugavilomitidawovi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/62092297-a0e8-42a9-aac4-92f6f4cb8c66/what_is_an_rslogix_5000.pdfIn PDF document text
- https://s3.amazonaws.com/zategafozasiru/5th_grade_common_core_math_division_worksheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58afa950-84e1-4a29-a68b-ba256338b150/john_deere_310_backhoe_bucket_specs.pdfIn PDF document text
- https://s3.amazonaws.com/dudurat/92009808432.pdfIn PDF document text
- https://1a2149e7-ca7f-4e7c-a584-0e483de6f3af.filesusr.com/ugd/9219f8_8054cec8cf5a4466aaeef9022ba9a13b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2221694c-6396-4b24-97d9-9d72aeb4dc66/lirr_huntington_to_jamaica_station.pdfIn PDF document text
- http://sulijugofogim.onlinewebshop.net/jasefilatabereguji.pdfIn PDF document text
- https://s3.amazonaws.com/zidenigad/xamarin_android_bitmap_scale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af146773-7bc1-443b-af27-8719bdbe1d12/balancing_chemical_equations_worksheet_answers_key.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f8b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8B9 | 5524 bytes |
SHA-256: ab125bb6a6d0b6651102220e5cd691bb0f4fd9a8fcef5e3ebace5745cfc3a58f |
|||
font_01_sfnt_off00010b66.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B66 | 11436 bytes |
SHA-256: 2171d09652092f846118594fbeeee6defac6bcbfe4210697982c395a72fed442 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.