MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF document contains multiple heuristics indicating a phishing and potential malware distribution lure. It impersonates the UPS brand and uses a redirector URL, 'https://philabc.ru/pbw?utm_term=prime+minister+youth+loan+check+status', which is likely part of a phishing campaign. The presence of numerous external links and the ML classifier's high confidence score suggest malicious intent, possibly to download further payloads or harvest credentials.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://vubedokixe.weebly.com/uploads/1/3/4/7/134716192/fitisudokura.pdf.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://philabc.ru/pbw?utm_term=prime+minister+youth+loan+check+status PDF link annotation
- https://vubedokixe.weebly.com/uploads/1/3/4/7/134716192/fitisudokura.pdfIn PDF document text
- https://lizuxafemow.weebly.com/uploads/1/3/0/7/130776517/kejokisudo.pdfIn PDF document text
- https://bopuxokefira.weebly.com/uploads/1/3/5/3/135300507/zetugalimudat-pidefelevafiku-zurevapamasewa.pdfIn PDF document text
- https://vipizavubo.weebly.com/uploads/1/3/1/4/131407691/9770212.pdfIn PDF document text
- https://sisufowikukutu.weebly.com/uploads/1/3/4/3/134311685/nalixem.pdfIn PDF document text
- https://fefodenajefive.weebly.com/uploads/1/3/1/4/131437461/vemutululorirexesoka.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/785b25c1-965e-4926-bf50-a28341334fde/2927678249.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca92e1ca-ca1f-4e09-89ab-5ed63ffd49ec/nusoguneladotowewekove.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3431f0d-ec22-4e38-88b2-307ecc67bb71/taguxosopizome.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36e96eb6-2bd7-4f86-8dac-22c877f78d61/english_grammar_in_use_online_lms_version_4th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba2f52ff-5316-4beb-9da4-9662237a1591/dex_faith_build_dark_souls_2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5625fc12-ddf3-4e85-9a06-0167ebc6b96c/1917_20_dollar_bill_value.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/94caebdd-ac29-4753-9f8c-fa568eabcb99/2006_gmc_envoy_transmission_fluid_type.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04a3bb48-ba8d-4987-8886-6d038c9d0857/wine_enthusiast_silent_18_bottle_dual_zone_wine_cooler.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a63e2b8c-5759-4c61-aee7-38f06e8227a5/planes_y_programas_2011_secundaria_ingles_primer_grado.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/311cde0a-c0c6-4286-a5ea-f154a26a0bbc/fowatinaminozusawoserere.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cee8acfd-1d2c-4687-a97c-111cd69f69e9/panasonic_sa-pt170_home_theatre_system.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9e5cba5-3800-453d-87b0-9ab6501bf8d8/lawetefinenagagejuzidu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c0763cd-3c61-4f43-96bc-79e1e069caad/kisiwetukopokoxasilab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42796698-48a3-43c9-90bb-94ca481394ce/epson_waste_ink_pad_reset_utility.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f1e23b4-0c29-4ad8-8e83-761149558873/are_broan_and_nutone_the_same.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9f52691b-c8ca-4253-a588-cc584c233e85/where_to_find_boletus_divinity_2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b000e6d1-d9d9-499a-b2c9-64d038a4b1ea/22182144393.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d986.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD986 | 5088 bytes |
SHA-256: 20b9badf35e5f6af4a4a8b595a3f1e98044b91949855df45eae5887d5ee1f2b2 |
|||
font_01_sfnt_off0000eaa2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAA2 | 10808 bytes |
SHA-256: f3aa9eabc836e52fe2a6f4a3e0043d15eb5040131a254c1138da28ccfa0489c4 |
|||
font_02_sfnt_off00010f3f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F3F | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.