MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm or designed to redirect users to malicious sites. One of the extracted URLs, https://leonvi.ru/strik?utm_term=jesu+bleibet+meine+freude+piano+sheet+music, is a primary indicator of this redirection attempt. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure and heuristic firings point towards a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=jesu+bleibet+meine+freude+piano+sheet+music PDF link annotation
- https://zokaguwozan.weebly.com/uploads/1/3/0/7/130738936/9116906.pdfIn PDF document text
- https://dekedenavit.weebly.com/uploads/1/3/4/6/134612093/jomiledevej.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366961/normal_602ba2fe36292.pdfIn PDF document text
- https://xomixosusanit.weebly.com/uploads/1/3/1/4/131438267/016f2d171b45.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4427519/normal_5feb7f04bc27d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403271/normal_6045fa003660c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/vutame/xipetiginobaxizitaweb.pdfIn PDF document text
- https://s3.amazonaws.com/pasawe/a_b_c_d_2_song.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd26a079-333b-4450-adbb-6a6f30d86f56/11183927771.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e4d01ed-0238-4110-90e7-e1f01e276ca9/78534473932.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/95ba77db-178c-4232-8d9d-d8d31a8e6744/biniwibatepun.pdfIn PDF document text
- https://s3.amazonaws.com/dojivewobasuval/la_divina_commedia_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6a4db9f-93e2-4d93-b46f-f616933e862e/70695820975.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec34baab-c2de-4b55-8500-4a941e31848d/cisco_rvs4000_v2_firmware.pdfIn PDF document text
- https://s3.amazonaws.com/lakadutof/bujozas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d785abf-9b78-4a2b-bd0b-126fc2b019cc/79613225218.pdfIn PDF document text
- https://s3.amazonaws.com/timituvupame/how_to_get_error_codes_on_whirlpool_washer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6572fd4f-831a-4189-a7ff-80053ccbb598/walter_riso_de_mil_amores_frases.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1e5c88b-5f90-4a4f-b6cd-1bf266ac3393/nekut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/17e065a0-93b7-4737-b094-38811456fc55/49693966422.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/480f770e-86ff-49b3-9dd5-ca496c4001cc/monsters_vs_aliens_season_1_episodes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6581577d-a45d-45fe-b6b2-7479858ee7de/what_is_the_price_elasticity_of_demand_calculator.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba220794-4e59-4c71-a0ad-e652494976a8/jaxijetadomejapub.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011c8f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11C8F | 5524 bytes |
SHA-256: e8bea6eb03955fd28fa8f396f248c9539b8efe5d2306b86a03d09c89baf7981b |
|||
font_01_sfnt_off00012f20.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12F20 | 12176 bytes |
SHA-256: 71242c0afb63f901648f0efc94b7c06c6c6310b462d51f094c3b90d52aca48bf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.