MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. The document contains an external URI and a high-value business-email-compromise pattern suggesting payment redirection. The presence of a download button lure further supports the phishing attempt, likely leading to the download of a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LUREDocument describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/award?keyword=cambridge+english+empower+b1+pdf+free PDF link annotation
- http://mmamba.ru/vatajuxumujisusot4wrnq.pdfIn PDF document text
- https://bozetefaz.weebly.com/uploads/1/3/4/7/134733050/xefebebikut.pdfIn PDF document text
- https://pujowuvorokom.weebly.com/uploads/1/3/5/3/135347933/1f636e8aba67a78.pdfIn PDF document text
- http://tuzotumefakorok.scienceontheweb.net/english_speaking_course_for_beginners.pdfIn PDF document text
- http://supajukiligado.22web.org/47920750529.pdfIn PDF document text
- https://jigudeganulufis.weebly.com/uploads/1/3/6/0/136054519/xodubovadifirugamagi.pdfIn PDF document text
- http://plusstore.pro/63301004481m8pq0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://zobemodorujo.rf.gd/gujozinuzorufukabozolemi.pdfIn PDF document text
- http://femagela.myartsonline.com/pdf_ausfllen_online.pdfIn PDF document text
- http://xowomowipuzu.epizy.com/nexarolebi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8493ef96-120c-448f-89a8-22f72b9c3dda/what_year_is_my_new_home_sewing_machine.pdfIn PDF document text
- http://pewubik.atwebpages.com/nikok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/60aa3b89-79a6-4dda-a308-5fea962aae7e/cleaning_kitchenaid_stove_top_grates.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/157a40ad-4493-403e-9dad-1b3655627b4a/48772987362.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec2d3669-c42a-48fa-b70f-5c46b89aeab7/kenmore_90_series_washing_machine_parts_diagram.pdfIn PDF document text
- http://moxixezegosa.onlinewebshop.net/the_bible_in_arabic_sidney_griffith.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85a49bc6-024f-4486-b3fa-84765608fa34/8273169765.pdfIn PDF document text
- http://wabalegawamiraj.rf.gd/93952264926.pdfIn PDF document text
- http://xafekejo.epizy.com/what_does_sahib_mean_in_arabic.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004fcfc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4FCFC | 5644 bytes |
SHA-256: 25630b3803d67336d6a29d7d1f74c9e9445303b5a24006c6e8f0d72232c0322f |
|||
font_01_sfnt_off0005100e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5100E | 14464 bytes |
SHA-256: 5e4da8d13516bb1677cc4b78567e3ec3f29d400bcbf403e215b407195f5ba63c |
|||
font_02_sfnt_off00053fbb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x53FBB | 16284 bytes |
SHA-256: 15b3e1dbb9946b03220896cf0b72fa5e39f337e3e3737d867298db659e05b1f5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.