MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, many of which point to disposable hosting and appear to be part of a link farm designed to redirect users. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to current events, attempting to disguise the malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=where+to+donate+clothes+in+seattle+during+covid PDF link annotation
- http://idealica-italiaoficial.site/live_stream_nba_finals_game_1_freeg7ig1.pdfIn PDF document text
- https://cdn.sqhk.co/nugopanage/d7KsAhg/north_star_high_school_staff.pdfIn PDF document text
- http://natikolom.site/pendragon_book_5pjt58.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393189/normal_6026333057603.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4483097/normal_5fc9be1958758.pdfIn PDF document text
- https://cdn.sqhk.co/nebafaveju/grhidge/surviv._io_unblocked_games_77.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415782/normal_6050e8cca62d8.pdfIn PDF document text
- https://cdn.sqhk.co/jataviwimog/gcijhcj/51071938393.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4375200/normal_5ff7765fe942f.pdfIn PDF document text
- http://reactivascotia2020.com/license_plate_lookup_free_online_canadagk8hm.pdfIn PDF document text
- http://slmit.fun/chhota_bheem_in_tamil_free_hdb6po5.pdfIn PDF document text
- https://cdn.sqhk.co/zokuwagopole/jigxkjg/12339111568.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407314/normal_605a71d25f74c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378599/normal_5fcbf515ef248.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383452/normal_6022706e5487e.pdfIn PDF document text
- http://tk-time.site/john_deere_z425_starting_problems0uf2x.pdfIn PDF document text
- https://cdn.sqhk.co/xajamenujo/Yhgia4W/51037156202.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://fe92b815-f0fe-4223-924b-659339f44b90.filesusr.com/ugd/8f64fc_3486cf7870f342fe91f1266f58e63150.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0ed40454-6380-4579-93b8-3e0d05933fdf/46521804972.pdfIn PDF document text
- https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_e4034b78c9614ba880329bc22bac728c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a32ae342-cb2a-42ec-8115-d100a120ffc1/verizon_g1100_router_cost.pdfIn PDF document text
- https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_be9ab05036fb409e8fcfff2e0a2aaa8d.pdf?index=trueIn PDF document text
- https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_637c2f8d810b4751a77f26b79685a13b.pdf?index=trueIn PDF document text
- https://94ac7338-8c66-48ed-b7e4-01cccba3eff0.filesusr.com/ugd/9b8421_f0a1ecba36ad43a6a54d0db98ca908a8.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb4e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB4E | 5272 bytes |
SHA-256: 725f54b4630630cced1c1dd410363258dad112dd58cbde4396339209eedf1408 |
|||
font_01_sfnt_off00010d48.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D48 | 11456 bytes |
SHA-256: bc85bb2386c09785613e87869090896ba8b6fd111db0df7f3468c3f14b9a83a1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.