MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by multiple heuristics and an ML classifier, with ClamAV detecting it as a phishing trojan. It contains a large number of external links, many of which are disposable or on suspicious domains, suggesting a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to movie titles and application names, likely as lures.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=nicholas+sparks+see+me+full+movie PDF link annotation
- https://rowevopa.weebly.com/uploads/1/3/1/8/131872281/koposumugukaseduda.pdfIn PDF document text
- https://funesovikigaje.weebly.com/uploads/1/3/0/7/130740183/3584238.pdfIn PDF document text
- https://fodigedij.weebly.com/uploads/1/3/2/7/132740281/5861358dc.pdfIn PDF document text
- https://lepepapiminokuj.weebly.com/uploads/1/3/4/4/134493398/fejigizowevu.pdfIn PDF document text
- https://ronukava.weebly.com/uploads/1/3/4/8/134885886/sijuraje-sazizu-refesetelisatup.pdfIn PDF document text
- https://pevaluxuduta.weebly.com/uploads/1/3/4/5/134502983/2344052.pdfIn PDF document text
- https://rofokaragi.weebly.com/uploads/1/3/2/8/132815015/juroxenadawemopumoba.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0dc4aa2d-1cff-495e-ada5-d3433af0f253/49527550479.pdfIn PDF document text
- https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_c6cb122ee35c402da19dd7780f15e7ec.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pajukovuxetu/alif_drama_title_song_mp4.pdfIn PDF document text
- https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_99d0c8e44b50496c9ef0079dc09b6196.pdf?index=trueIn PDF document text
- https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_6a223b4e83c347e8a7dc27bd4e678c72.pdf?index=trueIn PDF document text
- https://1682489e-d94b-4f22-b6a6-c8ecb623ca2e.filesusr.com/ugd/5f226e_54e73a3a55cd4b048ae59e4704ad69f7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zobuwubedak/island_of_doctor_moreau_documentary_netflix.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/652d2244-55df-4870-9ca5-db9fedd8d5e2/vox_ac15cc1_used.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42560510-aee3-460b-baea-027cba7002fc/honeywell_tower_fan_hfy045_manual.pdfIn PDF document text
- https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_2deb24da73ae4f8db2e01e48eb002c5b.pdf?index=trueIn PDF document text
- https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_7af726c01c074390b18de143a1f784c9.pdf?index=trueIn PDF document text
- https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_7133b0394f9341c3851cea2effc11499.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/586f60d0-3c99-40d1-8290-27e37faac9a5/how_to_reset_epson_l120_waste_ink_pad_free.pdfIn PDF document text
- https://b4140449-9b96-4148-8619-c9b3eed7b48c.filesusr.com/ugd/c33cdb_5886b882471945038ff7efef7a68033e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f326.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF326 | 5348 bytes |
SHA-256: a20c4dc491888d1e3e00967797caf467588ea78f63f180c5f1649af0dada2224 |
|||
font_01_sfnt_off0001053d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1053D | 11300 bytes |
SHA-256: 9a01e2cf65668ca6717fd311c2e5709400befd2795a1cba33179833036fe674f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.