MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are dynamically generated and point to potentially malicious domains, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent, likely to redirect users to a site like https://mezovuduw.ru/123?utm_term=ocarina+music+player+manuale for further exploitation. No scripts were extracted, but the PDF structure itself is indicative of malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/123?utm_term=ocarina+music+player+manuale
- https://puwegamojone.weebly.com/uploads/1/3/4/7/134702565/3945695.pdf
- https://wisomekusarukit.weebly.com/uploads/1/3/5/3/135384288/5934252.pdf
- https://xifofenanupov.weebly.com/uploads/1/3/4/8/134857182/4722185.pdf
- https://cdn-cms.f-static.net/uploads/4387226/normal_606409a027119.pdf
- https://static.s123-cdn-static.com/uploads/4495681/normal_5ffd1ff4ba2ff.pdf
- https://cdn-cms.f-static.net/uploads/4382429/normal_5fd99292b3bb2.pdf
- https://cdn-cms.f-static.net/uploads/4369928/normal_602ac6f73134a.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/90f9351b-ab93-4a41-bef9-0c95db1f9532/how_do_i_program_my_jumbo_universal_remote_to_my_tv.pdf
- https://uploads.strikinglycdn.com/files/c1d3a6d0-4c48-4f31-962f-50af3676157b/26454782934.pdf
- https://uploads.strikinglycdn.com/files/ae142737-1327-40ba-89e5-ebe5f661f2ac/66370035992.pdf
- https://uploads.strikinglycdn.com/files/6764720e-b6e4-4389-a192-1d2a29eace8a/99450674978.pdf
- https://uploads.strikinglycdn.com/files/1a1e3db0-67b5-4e4c-92a1-c3b1eb92cb95/nostalgia_6_quart_ice_cream_maker_reviews.pdf
- https://uploads.strikinglycdn.com/files/e0767593-9ad4-4092-a60f-3ff51913a7c4/a_dolls_house_play_analysis.pdf
- https://uploads.strikinglycdn.com/files/5ae96a2e-550a-45aa-a27c-b213cde9d324/eth_cepher_meaning.pdf
- https://uploads.strikinglycdn.com/files/c3a1e918-6059-453d-9338-72859ff2262a/94343895362.pdf
- https://uploads.strikinglycdn.com/files/2c288f00-c47e-4c4a-968b-57dcb2706586/where_can_i_refill_primo_water.pdf
- https://uploads.strikinglycdn.com/files/0c3d5e91-d4b5-4bc6-b9b6-bc9aed0c10b2/wedoxat.pdf
- https://uploads.strikinglycdn.com/files/0655b3b7-d9f1-4d14-8d39-7c50964e1f5f/math_vision_project_module_2_answers.pdf
- https://uploads.strikinglycdn.com/files/14524c55-bb86-4577-918e-3aabe18e8b92/the_barbell_prescription_free.pdf
- https://uploads.strikinglycdn.com/files/c5960458-eb8a-4f5d-b034-c11ef89a5fd1/sopejafapebivekixoridu.pdf
- https://uploads.strikinglycdn.com/files/da4b8602-cb0d-4469-b538-a3f016eb8891/walmart_photo_center_canvas_prints_canada.pdf
- https://uploads.strikinglycdn.com/files/3ca3f126-a783-44a5-9d39-edd7b7c87b6b/5_steps_to_ease_lockdown_northern_ireland.pdf
- https://uploads.strikinglycdn.com/files/639baa9e-ab5f-46bc-afc7-1e0c1ca30dc4/nuveromugotov.pdf
- https://uploads.strikinglycdn.com/files/c183b427-62f7-44ea-84f0-5ee3a5ed759f/how_to_thread_a_bobbin_on_a_singer_simple_sewing_machine.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e447.bincd45ec63280139be6c9088f4d5d04f668143ed6f70a4d03978d7dece4ca4586a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE447 | 5208 bytes |
font_01_sfnt_off0000f5ec.bin582a6f20077a84ef54bd6c112614718cf3bb3fd24a3de7f5bab4ddde1d5ce49e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5EC | 11600 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.