MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results. The primary malicious URL identified is 'https://resalured.ru/strik?utm_term=tecsun+pl+660+manual+deutsch', which is presented in a way that suggests it is a link to a technical manual, likely to trick users into visiting a phishing or malware distribution site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=tecsun+pl+660+manual+deutsch
- https://cdn.sqhk.co/burexewejam/jvgciec/gekuvalexezezujeno.pdf
- https://cdn.sqhk.co/riwifesineji/bIjyAyx/lost_in_harmony_mod_apk_2._2._2.pdf
- https://wivaralizufijol.weebly.com/uploads/1/3/1/4/131483386/e90316d8f.pdf
- https://cdn.sqhk.co/gasariba/jr89hjJ/godotexokuvokutoj.pdf
- https://cdn.sqhk.co/sowojusawepu/jiiIibB/ordinal_data_examples_in_healthcare.pdf
- https://cdn.sqhk.co/tefulobesa/jhveRie/assistive_touch_iphone_11.pdf
- https://kekisadubivef.weebly.com/uploads/1/3/3/9/133986731/c04df44a49038b.pdf
- https://cdn.sqhk.co/tosuwukiwate/wzUngdy/lozijovuvakaxomefo.pdf
- https://cdn.sqhk.co/veletafi/hVI7iby/cracker_barrel_locations_in_pennsylvania.pdf
- https://cdn.sqhk.co/dutudovajud/dhiAcjb/beyblade_amino_apk.pdf
- https://cdn.sqhk.co/kezulegol/fbegjgj/daily_budget_planner_excel_template.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_843c9b7336404e588b8f58253489ec75.pdf?index=true
- https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_426ae25be88842ddafc1f3a304db9869.pdf?index=true
- https://s3.amazonaws.com/gixirojozogufux/sumogituzoza.pdf
- https://4a5660cc-52a2-48ff-9acb-4b4f1704cb6e.filesusr.com/ugd/81868d_8e1ae81921a941c2b71d426dc154b12b.pdf?index=true
- https://s3.amazonaws.com/benuka/trigger_interview_questions_and_answers_in_sql_server.pdf
- https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_cc77d7ac5aeb43299d089cd7f010b746.pdf?index=true
- https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_c39a4a0942824c77970afd9576396c1c.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e27a.bincb1e6a3d3f06c6a40c83ec343e881f7cb7123b9270643675079fd48b8d108d41 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE27A | 5184 bytes |
font_01_sfnt_off0000f3e7.bin4d8e80b79fd44776b7b2f6251fdedeec8d875e441daa494605b9556cdf71d66d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3E7 | 15092 bytes |
font_02_sfnt_off00012214.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12214 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.