MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded links to malicious redirector infrastructure, specifically pointing to 'dafemum.ru'. The document's content, though heavily obfuscated, appears to be a lure related to 'solar battery tender for car'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or scamming purposes.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=solar+battery+tender+for+car In PDF document text
- https://cdn-cms.f-static.net/uploads/4381287/normal_604005f2f2bf1.pdfIn PDF document text
- https://xotogifove.weebly.com/uploads/1/3/1/4/131406695/7163149.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449775/normal_600b2a5ab663e.pdfIn PDF document text
- https://xulazipilo.weebly.com/uploads/1/3/5/9/135958699/viwevifuvokukegazi.pdfIn PDF document text
- https://cdn.sqhk.co/girewobo/pjbIggp/chess_rush_best_lineup_season_4.pdfIn PDF document text
- https://cdn.sqhk.co/zapimafe/vyhdQSU/wosogav.pdfIn PDF document text
- https://fizubuvi.weebly.com/uploads/1/3/5/3/135301632/4302414.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380545/normal_6040177430fc5.pdfIn PDF document text
- https://cdn.sqhk.co/lagidexetin/jieciN5/matinikiresora.pdfIn PDF document text
- https://cdn.sqhk.co/lepudijazur/eBsmwhe/download_call_of_duty_mobile_apk_uptodown.pdfIn PDF document text
- https://cdn.sqhk.co/wakewafo/dlhggdk/46990629313.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/mixanaz/nipowegenoz.pdfIn PDF document text
- https://s3.amazonaws.com/fikuvine/1__6.pdfIn PDF document text
- https://e33362eb-94ba-4427-a888-6f4863169a18.filesusr.com/ugd/36ce96_977720e99f4942dbbd04d14a588e6138.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vawoginele/42894759808.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fbb71be4-179e-452a-a833-11235f29e8e0/what_are_the_different_decorating_styles.pdfIn PDF document text
- https://s3.amazonaws.com/vazisi/fizikaje.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d42f6631-a4bc-4094-9256-0afb357f2b05/black_ted_dekker_summary.pdfIn PDF document text
- https://969948a0-d7f7-4827-958e-a3856fee42d4.filesusr.com/ugd/9d40bc_7ec135213d8a408cb25a98a50e8763f6.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/makumapikeze/79847109570.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e48c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE48C | 5184 bytes |
SHA-256: 54a6250b3290057ce757fbc74d5e044d13d2ab7aa77618767f4699599ae55090 |
|||
font_01_sfnt_off0000f645.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF645 | 12124 bytes |
SHA-256: c02824f0874c3d9fc087057269964ba3f761cc73012aaef0bac0b4534ffcf3a3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.