MALICIOUS
244
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It contains a large number of embedded links, many of which point to disposable domains or known malicious redirectors, suggesting an attempt to direct users to phishing or malware-hosting sites. The document body, though heavily obfuscated, contains a deceptive lure related to teeth whitening, further supporting a phishing or scam-based attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=do+your+teeth+get+whiter+the+more+you+brush In PDF document text
- https://nuwomanat.weebly.com/uploads/1/3/4/6/134664603/6881612.pdfIn PDF document text
- http://theraisins.pro/6303974959mfngn.pdfIn PDF document text
- https://finepeva.weebly.com/uploads/1/3/5/3/135347337/8308787.pdfIn PDF document text
- https://kikuvutu.weebly.com/uploads/1/3/5/9/135965216/nozezegapow.pdfIn PDF document text
- http://msertis.xyz/sakexiennl9.pdfIn PDF document text
- http://zabekoreju.iblogger.org/kiran_publication_bank_po_maths_books_free_download.pdfIn PDF document text
- http://vilopeg.xyz/power_saving_back-_ups_xs_1500_manual6x8kn.pdfIn PDF document text
- http://prizinsta.online/19642472459w660q.pdfIn PDF document text
- http://bedomukuruxe.22web.org/zadeloxidotarupapepi.pdfIn PDF document text
- https://baseparefawufif.weebly.com/uploads/1/3/1/4/131453046/gupesaxo.pdfIn PDF document text
- http://wgathering.org/40063671140pybxq.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_4d2957eb88dc403699630b4daa402aa2.pdf?index=trueIn PDF document text
- http://moliduduzabet.epizy.com/95963977629.pdfIn PDF document text
- http://valigajemebid.rf.gd/53898386035.pdfIn PDF document text
- https://fdb0147f-387d-4908-9c93-1ccdb5bf775f.filesusr.com/ugd/aea2e0_a2d466268d3f4101b5f3c0d376a74306.pdf?index=trueIn PDF document text
- https://0cc2a7d0-6f33-4335-9ec9-554d9418487e.filesusr.com/ugd/cb4a18_4a1d0a753b134f73b4ba674e516e885c.pdf?index=trueIn PDF document text
- https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_c98d6d740a994346a3519d29a14e8d41.pdf?index=trueIn PDF document text
- https://4d3f6715-1114-433d-a4b7-45a5e22e3858.filesusr.com/ugd/ce86b4_b0388b99dc5643279efedb3ee0fd7c59.pdf?index=trueIn PDF document text
- https://de315c38-daa2-4293-b666-e554ba9b7d65.filesusr.com/ugd/564d2e_7e0a0228053c4a08b4f4a5ae2c48b022.pdf?index=trueIn PDF document text
- https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_2ec1304c247943619afe5126a10564c8.pdf?index=trueIn PDF document text
- https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_3e8a98aafd92417697ca6ed8770d4224.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFEF | 5192 bytes |
SHA-256: 9765123f55d67b5ccc5a3b08e6d3591878d32b5bfbe52bd488ef7013f0ff49d6 |
|||
font_01_sfnt_off0001018f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1018F | 10804 bytes |
SHA-256: dc484ccd46bd2e63e83a3ee7c6668cd4df527afab4a5df3b8590a402eb5edc69 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.