MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains a significant number of external links, many of which are obfuscated or lead to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' and 'CLAMAV_DETECTION' heuristics. The primary malicious URL identified is 'https://dafemum.ru/strik?utm_term=best+month+to+visit+the+wave+arizona'. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=best+month+to+visit+the+wave+arizona
- https://static.s123-cdn-static.com/uploads/4495399/normal_5fefa846db4da.pdf
- https://cdn-cms.f-static.net/uploads/4393754/normal_6066bcba811c5.pdf
- https://cdn-cms.f-static.net/uploads/4409623/normal_605041db0b5d9.pdf
- https://cdn-cms.f-static.net/uploads/4489054/normal_602ade3127152.pdf
- http://fujigukatujewu.medianewsonline.com/top_paw_double_door_folding_crate_instructions.pdf
- https://cdn-cms.f-static.net/uploads/4477164/normal_5fe8a0ae12ad6.pdf
- https://static.s123-cdn-static.com/uploads/4423136/normal_5fdeae9769165.pdf
- http://lebuvowune.getenjoyment.net/99939429210.pdf
- https://cdn-cms.f-static.net/uploads/4375077/normal_606b8a005010b.pdf
- https://cdn-cms.f-static.net/uploads/4481069/normal_6037db33db41d.pdf
- http://mizizufiku.mywebcommunity.org/17852485111.pdf
- https://static.s123-cdn-static.com/uploads/4481424/normal_5fec9753ad470.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://78f121e6-5824-477f-9480-4bf23eba804c.filesusr.com/ugd/9564ad_45549fd0164145319b70dc2c42ad2a93.pdf?index=true
- https://uploads.strikinglycdn.com/files/bb964706-eb9a-49f1-b096-d5311e3a3163/lozidefokesivuwes.pdf
- https://uploads.strikinglycdn.com/files/a23934b5-468a-4e30-b0b9-fe94636da725/craftsman_v20_7-1_4-inch_sliding_miter_saw_kit_cmcs714m1.pdf
- https://uploads.strikinglycdn.com/files/51368b7f-bd72-43cf-8a0a-d9b052cc89ca/65594300452.pdf
- https://uploads.strikinglycdn.com/files/bdc43dda-59e8-4ef6-934b-4b065c0acf7c/rcbs_chargemaster_lite_vs_1500.pdf
- https://3682d434-6e27-4ac8-9ac2-d3ec24fa429c.filesusr.com/ugd/9b5f63_d02c35f74a0b48609ec03e97cf9d02f9.pdf?index=true
- https://uploads.strikinglycdn.com/files/a8464414-bdd8-4289-8d5f-7061bc8f54a1/safeline_metal_detector_wiring_diagram.pdf
- http://lazuletezofik.onlinewebshop.net/bijowapupomujufefosikiz.pdf
- https://uploads.strikinglycdn.com/files/200cdf43-c52a-4294-9597-a827f488fc20/resumen_completo_de_la_divina_comedia.pdf
- https://uploads.strikinglycdn.com/files/8f5dcb17-87b1-4438-b711-114b2aa4dd18/civil_engineering_materials_list.pdf
- https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_36149cee74ca47fc9d82958f1a5d02df.pdf?index=true
- https://uploads.strikinglycdn.com/files/b9e30cc0-6cac-444d-9363-bebe666cd501/jemizakedobisemutaxalif.pdf
- https://uploads.strikinglycdn.com/files/6b4f1e55-74c3-4c64-a2b6-44ea68e7c671/what_percent_dividend_does_apple_pay.pdf
- https://uploads.strikinglycdn.com/files/29041a86-0549-417d-8942-3f8f9862ca94/78903949111.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb8d.bin724b35a36502f3a0678b7d9b81136e383bd32546617d892250c719ec92f07862 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB8D | 5144 bytes |
font_01_sfnt_off00010cf8.bine3b92472d3763de81fa01ae3b2929501f9aa6494d2e51e7e3b0cb878a71625bf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CF8 | 11276 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.