MALICIOUS
244
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of links, many of which point to disposable hosting and redirect to malicious infrastructure. The document body, though heavily obfuscated, appears to be a lure related to 'Harry Potter books'. The presence of numerous external links and a critical heuristic firing for malicious redirector links indicates a phishing or scam attempt. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=harry+potter+books+in+order+set In PDF document text
- https://static.s123-cdn-static.com/uploads/4413109/normal_5fce0b660a8fe.pdfIn PDF document text
- https://cdn.sqhk.co/lanuniwa/wibTicw/69686606835.pdfIn PDF document text
- https://sedarujewajoto.weebly.com/uploads/1/3/0/9/130968957/c6ec7d0cf9ec0.pdfIn PDF document text
- https://cdn.sqhk.co/piredonina/b24ihhb/steam_table_software_free_download.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4425912/normal_5fc95e361c3c1.pdfIn PDF document text
- http://stroiline74.ru/vumufalemadogqire9.pdfIn PDF document text
- https://zesalogerevuj.weebly.com/uploads/1/3/4/6/134684883/31000de965c9d5.pdfIn PDF document text
- https://cdn.sqhk.co/vagizabibo/t4iaGih/my_smart_house_reviews.pdfIn PDF document text
- https://sijujufe.weebly.com/uploads/1/3/4/6/134696532/jegekejex.pdfIn PDF document text
- https://bazafegaxu.weebly.com/uploads/1/3/1/3/131383427/nunepigusimetevinom.pdfIn PDF document text
- https://tixatodaja.weebly.com/uploads/1/3/4/5/134507568/rometibog_zovavorenegu_darijosorafomar_ditoj.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378425/normal_5ffb913a4cc76.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381766/normal_604187dee3be8.pdfIn PDF document text
- http://badgesverified.com/xelegulixuvovonapipodexuwm12i.pdfIn PDF document text
- https://xavapijiwo.weebly.com/uploads/1/3/3/9/133997403/8735275.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374522/normal_6040483eed01b.pdfIn PDF document text
- https://geliwesirodired.weebly.com/uploads/1/3/1/3/131382982/9820008.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/13edfa64-35b1-4011-a458-4aa00d712865/unity_technologies_stock_ipo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4855000-4bb7-47cc-8624-10283b4289e2/31051642159.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2ab.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2AB | 5188 bytes |
SHA-256: b9ffca46f98ad67e2fa20a1e8d0b3f07c05c0d45fcc9af2afa790446e4387abc |
|||
font_01_sfnt_off00010459.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10459 | 11880 bytes |
SHA-256: 8afdfc7f335debdc5802849634b2d395721434dadec832ebc1cd6bbbd95662e2 |
|||
font_02_sfnt_off00012d09.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12D09 | 16304 bytes |
SHA-256: 334a632046566dba1e13aa2ad28522ffc4701ff005b1d667d8ded0e84145bcf3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.