MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF was flagged by multiple heuristics as malicious, including a critical alert for linking to known malicious redirector infrastructure. The ML classifier also assigned a high probability of maliciousness. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself facilitates the malicious redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/strik?utm_term=introduction+to+management+information+system+abac In PDF document text
- https://static.s123-cdn-static.com/uploads/4489730/normal_5ff30d9cb3b8d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374211/normal_6020fdedc1671.pdfIn PDF document text
- http://duzixofiwisegi.mygamesonline.org/du_b._ed_syllabus_2020.pdfIn PDF document text
- http://tokio-2020.fun/wosomop93f81.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415740/normal_603f065a57143.pdfIn PDF document text
- http://memaberenux.scienceontheweb.net/ibps_clerk_recruitment_2020.pdfIn PDF document text
- http://mishabelle.ru/transformation_of_quadratic_graphs_worksheet_4-7lbn90.pdfIn PDF document text
- http://freefire-gifts.com/7439543744cruxo.pdfIn PDF document text
- http://mevukavotidu.getenjoyment.net/8675964168.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/e61fd825-fb9a-470a-b092-6ea066baf463/omega_juicer_customer_service_canada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7bd0b92d-2035-4572-aba5-f33898a37533/how_much_is_smith_corona_typewriter_worth.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f9c8c1c2-2745-4268-905a-3b474ab6b8da/gibasesedavube.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5ee2fab-968b-4689-8609-4d71daf10d2b/bijawawopodelu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0166eeac-988f-4070-a0c0-3774097e45fd/how_do_i_write_a_paragraph_in_a_single_cell_in_excel.pdfIn PDF document text
- http://zenakezogutomu.onlinewebshop.net/phn_mm_dch_file_sang_ting_vit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e9450a9-c376-49ea-9a2f-d3ce6c201159/83608990030.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e0e1c406-5444-4e19-91d1-7f21a43e9e15/fetexar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7c06cc8-2c89-48d7-981e-129f9d1267cf/dlink_powerline_firmware_update.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4ead95f-6a34-4444-962f-e8de3969ba9d/3113085706.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/103ead43-16aa-46f1-bc9f-6345fec43f4a/asus_rt-n66u_wireless_speed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd4227ae-56d7-4b95-9bba-a1d3ad2779d8/66291458338.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4ef3f9a5-9d0a-4700-9704-967aa79c8fd7/oster_toaster_oven_costco_canada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8f8ed58-a233-4f65-90ae-a214dcaf2566/39305303661.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/382185ac-e34c-4fe9-ba74-d21fb1462ae2/xubanodawusa.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010764.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10764 | 5488 bytes |
SHA-256: 82522c37d666ded53fab18f9f1b6eae24dd4e4e14530bc3b15e3a1b347eb5025 |
|||
font_01_sfnt_off00011a01.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A01 | 12236 bytes |
SHA-256: 26abc4eef22c67cd4e414fee82da379812ac712910371038b50ce3c239e2b17a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.