MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple heuristics indicating it is a link farm and is flagged by a machine learning classifier as malicious. It embeds a URL that redirects to a suspicious domain, likely intended to host a phishing page or a second-stage payload. The document body, though heavily obfuscated, contains references to a 'Bunker hill wireless security camera', suggesting a lure to entice users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=bunker+hill+wireless+security+camera+62367 PDF link annotation
- https://cdn.sqhk.co/kawiwitifa/chd0ERR/nalawowexojovup.pdfIn PDF document text
- https://cdn.sqhk.co/genopeno/jcQeItZ/89874418026.pdfIn PDF document text
- http://wumiwuzigimo.mywebcommunity.org/human_anatomy_book_bd_chaurasia.pdfIn PDF document text
- http://misifebofol.mywebcommunity.org/financial_advisor_interview_questions_and_answers.pdfIn PDF document text
- https://cdn.sqhk.co/mezadisedud/xEhdgdh/elite_motors_inc_waukegan_il_60085.pdfIn PDF document text
- https://cdn.sqhk.co/kowaziwaso/3QgcXja/floor_is_lava_simulator_parkour_3ds.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393018/normal_602e4531c8756.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448343/normal_5febd0ec189f0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://da5bec28-7969-4117-8ffb-5069fce5e80c.filesusr.com/ugd/31593d_fb2d850f6f20470db6d5008ebe74e38e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fdb8a5ea-e26b-466d-817c-c97470912a21/62239603152.pdfIn PDF document text
- https://s3.amazonaws.com/jazuravazaguz/judumudakawiwivopalakag.pdfIn PDF document text
- https://74f55dc1-c9a5-4be3-8cb6-5a41d2e6c5ca.filesusr.com/ugd/bacb18_2852b27a8d8647d3b0fbbf267bc2e062.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/203afa4c-3eb2-463c-9323-304346d3b2f6/usps_first_class_mail_international_tracking_india.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31d6ba89-b729-463f-9e93-35c1eca6bc0d/black_and_decker_5_cup_coffee_maker_cleaning_instructions.pdfIn PDF document text
- https://s3.amazonaws.com/zosevid/22736673369.pdfIn PDF document text
- https://a54de82d-0003-4787-801b-d7ee719c780a.filesusr.com/ugd/8d57bd_a8f285bddfe544eca0df74d8834fab0d.pdf?index=trueIn PDF document text
- https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_dd1837e3a82b470698467a8e7933c89e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nasitevu/how_to_move_window_using_keyboard.pdfIn PDF document text
- https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_0e922c827ae44cd5919fb93a1eaee945.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b89bd3c4-ba8d-4b5c-93c6-3318524caf28/tezanew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1708f32a-5ec5-4995-8d32-913628bb9250/9377821175.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f4c9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4C9 | 5648 bytes |
SHA-256: 8b229b4f9e9f8a8d348a72babe45dedff5bebe0583db12f09497e4a667766a92 |
|||
font_01_sfnt_off000107e6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107E6 | 10976 bytes |
SHA-256: 030a5f982b5db9b39a1b56bfb3d161935286656f5476212978398c7f57e05a8a |
|||
font_02_sfnt_off00012d5a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12D5A | 4324 bytes |
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.