MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document exhibits characteristics of an advance-fee scam, using lures related to lottery winnings or parcel deliveries. It contains a mass of external links, with the primary malicious URL being https://pelibifir.ru/wix?keyword=concise+guide+to+jazz+pdf+free. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to phishing or malware-hosting sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/wix?keyword=concise+guide+to+jazz+pdf+free
- https://cdn-cms.f-static.net/uploads/4383568/normal_6018daf3471d4.pdf
- https://static.s123-cdn-static.com/uploads/4393488/normal_5ff5a7d0a2288.pdf
- http://vegekezivujid.22web.org/how_to_verify_registration_number_of_vehicle_in_punjab.pdf
- https://static.s123-cdn-static.com/uploads/4408588/normal_5ffd664cdee7f.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://6ce95562-7558-49ee-a7b0-b3003db3b0e9.filesusr.com/ugd/d13e1f_ac1f849a599b4036b324fe7023f5f60f.pdf?index=true
- https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_94029a4fe75d4f63b8ff0c89d8199b4a.pdf?index=true
- https://uploads.strikinglycdn.com/files/a06bdf92-4e04-4825-aeeb-be08bf73524f/fugimozanegone.pdf
- http://kujafugakare.epizy.com/tubisidifav.pdf
- https://uploads.strikinglycdn.com/files/6d2cc77f-0404-4508-a5fe-8b5639770b9c/ccna_routing_and_switching_complete_study_guide_download.pdf
- https://6376acfe-5884-4251-b3d5-19a03c044549.filesusr.com/ugd/de3d83_f786197224a64e9684e15c64d290e2c0.pdf?index=true
- https://b585a76b-fab5-4024-b0d2-f3ad95444197.filesusr.com/ugd/404203_b3a71f93bac244a68c6826c47e33dfcb.pdf?index=true
- https://e5058785-d3d1-442e-b0ad-d0045053dde7.filesusr.com/ugd/17c622_bd44489a8b664a8898ba724b199b3465.pdf?index=true
- https://6d23287f-a15b-43b7-8d69-700c0e01f504.filesusr.com/ugd/185c00_e6e7db51dfd640eba8f51a24bd74fac9.pdf?index=true
- https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_7faf97cfa5ee41f28f78b7aa079a26db.pdf?index=true
- https://uploads.strikinglycdn.com/files/47086eb0-e1de-48ce-acee-a6c646d78a6c/jifawewenexizaf.pdf
- https://uploads.strikinglycdn.com/files/a5c949f7-637a-4c81-84c1-3e07bcc16851/anselm_academic_study_bible_new_american_bible.pdf
- https://538d8494-0c7d-401a-b890-0485f6bc7bca.filesusr.com/ugd/29c71c_7dd5855bd7f9492ab5fdff40bba78237.pdf?index=true
- http://tuxefefili.epizy.com/36763274308.pdf
- https://uploads.strikinglycdn.com/files/f9d73bda-06a3-4ed2-ad9f-c2f2b6620964/reading_comprehension_worksheets_3rd_grade_common_core.pdf
- https://uploads.strikinglycdn.com/files/2813c44c-3f76-4cb1-a4cd-a91604bf930f/libro_las_claviculas_de_salomon.pdf
- http://zovavabiw.epizy.com/rifebenapemetopuvezeb.pdf
- https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_2181fb3526bf44bba8b554b15152d377.pdf?index=true
- https://uploads.strikinglycdn.com/files/c1a7cb76-1ddd-4157-930b-35bed2fb6eb4/trig_functions_derivatives_calculator.pdf
- https://uploads.strikinglycdn.com/files/87bec99b-0c65-426b-9e45-f3a4db2a2764/jawamaniwizepewow.pdf
- https://uploads.strikinglycdn.com/files/0bd47910-c6a1-4ccb-820b-126b49bd99a6/line_6_spider_v_240_mkii.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012ce7.bin7408297c2e2c0685265dfa893ac90cf97f794a1fe27de952dc83be4345a14f2f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CE7 | 5320 bytes |
font_01_sfnt_off00013f1f.binc5dcb78f17d7a06879a7df3edd2dbbea5ac118dc9f4f3aff8efc43521b1d0125 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13F1F | 12292 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.