MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, many pointing to disposable domains, suggesting a link farm or phishing attempt. The ML classifier and ClamAV both flagged this PDF as malicious, specifically as a phishing trojan. The presence of embedded URLs and the heuristic identifying it as a link farm on disposable hosting indicate a malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9965
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/strik?utm_term=book+of+enoch+dead+sea+scrolls+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4482402/normal_60522c96655cc.pdfIn PDF document text
- https://tevirilozarenov.weebly.com/uploads/1/3/2/6/132695732/1843156.pdfIn PDF document text
- http://wumomotetidofe.getenjoyment.net/epson_v370_specifications.pdfIn PDF document text
- http://zolepop.mypressonline.com/kamaxezazipedusobijuru.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368218/normal_602ad622ae9d5.pdfIn PDF document text
- http://zuwazekanusur.mypressonline.com/discrete_probability_distribution_examples.pdfIn PDF document text
- http://kapovulup.mywebcommunity.org/kujudiwoluxit.pdfIn PDF document text
- https://duxegolukazokun.weebly.com/uploads/1/3/1/3/131398215/cd40f25f7f44df.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4475397/normal_606939d517a49.pdfIn PDF document text
- http://xevedudox.sportsontheweb.net/how_do_you_play_speech_breaker.pdfIn PDF document text
- http://movawizaxaxato.mywebcommunity.org/43263117246.pdfIn PDF document text
- https://kolijegidixut.weebly.com/uploads/1/3/1/3/131379325/wawusudidunabuxineg.pdfIn PDF document text
- http://pufivuziviv.mypressonline.com/diablo_3_barbarian_build_leveling.pdfIn PDF document text
- http://sutobep.getenjoyment.net/accounting_all_in_one_for_dummies_download.pdfIn PDF document text
- http://zobabikox.medianewsonline.com/ernest_hemingway_cats.pdfIn PDF document text
- http://mugukix.mygamesonline.org/77274709193.pdfIn PDF document text
- http://rafupofamurawaf.mygamesonline.org/fisoroletora.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/sowewazulejewi/91551661560.pdfIn PDF document text
- https://s3.amazonaws.com/vanatul/ipod_shuffle_user_guide_1st_generation.pdfIn PDF document text
- https://s3.amazonaws.com/befafuni/are_old_toy_cars_worth_money.pdfIn PDF document text
- https://s3.amazonaws.com/vapite/esi_phone_system_not_working.pdfIn PDF document text
- http://rijonitapadon.myartsonline.com/a_thousand_years_piano_sheet_music_free_easy.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00024cf9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x24CF9 | 21696 bytes |
SHA-256: 5ee1eab5cab4b3f0240ee3b4df5cae8a55017dd1700410f65c18fa8e493498e5 |
|||
font_01_sfnt_off000287ac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x287AC | 5016 bytes |
SHA-256: 4313074d391fe20a327bd8c6e53ba547e99122adc9573db31410010890e7bb34 |
|||
font_02_sfnt_off000298a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x298A9 | 18236 bytes |
SHA-256: 46be184330716d1b0586ea51b07a6e888442b2ce76405b761be4a6068b5a0d93 |
|||
font_03_sfnt_off0002ceb8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2CEB8 | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.