MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, indicating a likely attempt to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'Qt', suggesting it was generated by a tool rather than being a legitimate document. The presence of external URIs and the link farm heuristic strongly suggest a phishing or malware distribution vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=platicas+prebautismales+guadalajara+un+dia PDF link annotation
- http://gigurokubi.66ghz.com/spss_statistical_software_free_windows_10.pdfIn PDF document text
- http://ukranews.site/lowrance_mark_5x_dsi_power_cablecp1s7.pdfIn PDF document text
- https://cdn.sqhk.co/ketixudolu/EJzjbii/jurassic_world_alive_hack_apk_mod.pdfIn PDF document text
- http://prizinsta24.online/2456788756164p6t.pdfIn PDF document text
- http://zazuvivilug.iblogger.org/imperial_march_sheet_music_beginners.pdfIn PDF document text
- http://ru-dev.xyz/samsung_un60j6200_price5q1dx.pdfIn PDF document text
- https://cdn.sqhk.co/xonepogafix/ermjeid/venaxebebebepepi.pdfIn PDF document text
- http://copyrightsupporteds.com/identifying_accidentals_music_theory_worksheet_answersnmv7e.pdfIn PDF document text
- http://nemeloru.66ghz.com/verbs_worksheet_third_grade.pdfIn PDF document text
- https://cdn.sqhk.co/zujumatatub/mFh5hjE/42688694584.pdfIn PDF document text
- http://topshops.website/spanish_2_indirect_object_pronouns_worksheete8qdb.pdfIn PDF document text
- http://ukranews.icu/sat_math_sample_testsx4tut.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://67bb8873-ca08-4da4-87c0-60a8072ebff6.filesusr.com/ugd/a838c0_02a9ca6aba3a42f9bf0fbdddd82d69f0.pdf?index=trueIn PDF document text
- https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_eb9f8f564f2c4e83a28e1cf0dc95b920.pdf?index=trueIn PDF document text
- http://pinezininefos.epizy.com/colnago_c64_size_guide.pdfIn PDF document text
- https://8dfdba76-182f-4dc4-9dda-37a8c8d09dc9.filesusr.com/ugd/4ae4db_f36f8957ff6a4e979d69c7e9f7644c3c.pdf?index=trueIn PDF document text
- https://153f2bed-3501-4ec5-9468-ed1987511f6d.filesusr.com/ugd/f67134_5bfc9ebb7e70421a993903033415676f.pdf?index=trueIn PDF document text
- http://lajopagi.rf.gd/75577667761.pdfIn PDF document text
- https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_daa5fd9791674ad29ff9389c4403f7f0.pdf?index=trueIn PDF document text
- https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_5c27c852a0b64d429a976c106babf0f0.pdf?index=trueIn PDF document text
- https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_05bd4590336646b1a0edae376b8805a9.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9BF | 5608 bytes |
SHA-256: b69398df4cb4556e59090bf49e940fb3325887bd4bf87ec2a6f7c06341dd00bb |
|||
font_01_sfnt_off0000fcae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCAE | 4744 bytes |
SHA-256: 64824fd8a99e0294030ab08ce6414bb7aa4e4627ea15a93033eae40f3f1f8c74 |
|||
font_02_sfnt_off000109c0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109C0 | 12008 bytes |
SHA-256: 5e2ae6e9e8b6a63fe4a4e206c01bc1078fecedf7fd96c70cb96cfe51d7b0cbf8 |
|||
font_03_sfnt_off00013097.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13097 | 16760 bytes |
SHA-256: e6d2013e3dac338ce86c50060d190aedb04f958b6b6b96b61bdfefcd1867b12d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.