MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by multiple heuristics and a machine learning classifier, indicating a high likelihood of malicious intent. It contains numerous embedded links, with at least one pointing to known malicious redirector infrastructure. The document body, though heavily obfuscated, includes text suggesting a lure related to 'ultimate voice recorder android free', which is likely a pretext to encourage users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/123?utm_term=ultimate+voice+recorder+android+free In PDF document text
- https://cdn.sqhk.co/wimiwupo/iageyq7/nebimonogilaz.pdfIn PDF document text
- https://cdn.sqhk.co/bujavenizake/hhii72G/75371638853.pdfIn PDF document text
- https://cdn.sqhk.co/wazotifuk/5DW7sii/kudajuvavidiridufoda.pdfIn PDF document text
- https://cdn.sqhk.co/wajuletixex/Wjgifgj/speech_bubble_symbol_copy_and_paste.pdfIn PDF document text
- https://cdn.sqhk.co/ledodatefu/hcOtoHd/13723782948.pdfIn PDF document text
- https://cdn.sqhk.co/luwiwaduna/GcjjheP/74049251228.pdfIn PDF document text
- https://cdn.sqhk.co/fasixazijaz/8iegghg/sexetezexe.pdfIn PDF document text
- https://cdn.sqhk.co/budajawisore/iugMif3/nda_exam_eligibility_criteria_for_female.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://1c684d3d-b1aa-4d58-8f8e-408f9cf37fac.filesusr.com/ugd/64d889_88db63de3cb5400383cf2e1e6a97c60c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c499c1d3-15df-4e8c-9c40-638bbdb6b27a/70085512339.pdfIn PDF document text
- https://s3.amazonaws.com/wazotojemov/83896220055.pdfIn PDF document text
- https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_210204eafeb14677bdec8d65cfbceb6d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pajeriramal/dometic_15000_btu_rv_air_conditioner_problems.pdfIn PDF document text
- https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_256877be046545a88a88accddf0ebe45.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wivunonovef/balance_druid_form_glyph.pdfIn PDF document text
- https://18b62485-dce0-4e35-9712-b1d1f13fcb23.filesusr.com/ugd/296484_7591e5c81a6842c29675472e306453f0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/131361a3-93ee-4c7d-bee0-ffb04a69c373/garmin_vivofit_4_battery_sr43.pdfIn PDF document text
- https://s3.amazonaws.com/folexapurilowe/putibelisol.pdfIn PDF document text
- https://s3.amazonaws.com/fakuguvil/what_is_the_correct_chronological_order_to_watch_star_wars.pdfIn PDF document text
- https://s3.amazonaws.com/pevuwarobuvowa/basic_principles_in_the_coso_framework_for_internal_controls.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68eba033-a85f-4342-b1fa-9b335d9bdd46/how_to_connect_phone_to_projector_with_hdmi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/640b8fc0-3a17-442f-862a-a2e12b256a08/george_orwell_essays_penguin_modern_classics.pdfIn PDF document text
- https://s3.amazonaws.com/sabegokek/madden_25_draft_guide_ps4.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f7a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7A3 | 5040 bytes |
SHA-256: 7fc9b73b8c444d40559d514c67bebc5be1b4e203236513ceefb746327987b21f |
|||
font_01_sfnt_off000108bd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108BD | 10496 bytes |
SHA-256: b0f8807cec8c1eec33b067723d767ece44297ea0fd9247bc44af1e72cb4de9fd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.