MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URI pointing to 'fokemale.ru', which is flagged as a link farm on disposable hosting. The document body, though heavily obfuscated, appears to contain text related to 'Classic wow leveling guide alliance rogue', suggesting a lure. The presence of external URIs and the ML classifier's high confidence score indicate a malicious intent, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/123?utm_term=classic+wow+leveling+guide+alliance+rogue PDF link annotation
- http://sizinepizot.scienceontheweb.net/98060405741.pdfIn PDF document text
- https://sivajusirev.weebly.com/uploads/1/3/0/8/130814673/1115bc.pdfIn PDF document text
- https://riwurarelix.weebly.com/uploads/1/3/4/4/134484082/vusolaputujol_jimixibawixa_mavawurojotok.pdfIn PDF document text
- https://xinozujo.weebly.com/uploads/1/3/0/8/130874257/8247615.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373016/normal_603037fe992b3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4425256/normal_5fcb32c82e90c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365660/normal_604f6ce300fd8.pdfIn PDF document text
- https://bogixeguwumuzu.weebly.com/uploads/1/3/4/5/134503630/pavokuwagiwi_xaxaxokuw_limowafazeza.pdfIn PDF document text
- https://webimilosajepi.weebly.com/uploads/1/3/4/8/134859137/5250576.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://temolujipu.myartsonline.com/can_you_connect_soundbar_to_monitor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b1c50c0-652e-446e-b05c-9c6baa915c33/three_billy_goats_gruff_scholastic.pdfIn PDF document text
- http://nafaradevofipaf.myartsonline.com/camera_calibration_toolbox_for_matlab.pdfIn PDF document text
- https://s3.amazonaws.com/wulagisi/29201933008.pdfIn PDF document text
- http://zasuwunal.myartsonline.com/manedikedenipariviwo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5fc7f0c-ab7f-4c02-a529-2ce94805f0d4/hayward_ecostar_sp3400vsp_drive_replacement.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4be6047-d55a-4108-bda8-0d51d5792309/control_bluetooth_speaker_volume_with_tv_remote.pdfIn PDF document text
- https://s3.amazonaws.com/sefipa/64209689872.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4a1f62f-22a1-41f1-a23c-469278301045/list_of_stories_in_1001_nights.pdfIn PDF document text
- https://s3.amazonaws.com/tubukeganuji/wuses.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/669f2454-70c6-4dd0-8acd-52bbf0b62c11/arduino_programming_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/65f8cf23-5644-4ec1-8f17-356eb946a91e/53494688212.pdfIn PDF document text
- https://s3.amazonaws.com/bugutaj/37490550034.pdfIn PDF document text
- https://s3.amazonaws.com/wudibirewuduto/larusugebilopoxuvi.pdfIn PDF document text
- http://nujugeteteda.myartsonline.com/annotate_android.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d9bbcf3-f3e8-4b88-a75a-9ccc482887fe/sonukufa.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f46b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF46B | 5164 bytes |
SHA-256: c131bbc8f80ea04e799119d4d244a6e6ea5d69141e4ea11b077870bdd3d96e4f |
|||
font_01_sfnt_off0001061c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1061C | 10604 bytes |
SHA-256: c02d3cd494dea480c86f67408c9114487ad6a04ae15f2cf5b4968dcf0744696f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.