MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a high-severity heuristic indicating it's an image lure linking to an SEO redirector, designed for phishing. The embedded URL and the document body, despite being heavily obfuscated, point towards a deceptive download attempt. The ML classifier and ClamAV detection strongly support its malicious nature, likely as a phishing or trojan delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=artificial+neural+network+meaning+in+tamil PDF link annotation
- http://tusiteguluvora.getenjoyment.net/lurovifulirim.pdfIn PDF document text
- https://cdn.sqhk.co/gulijolane/RN0cFOT/92694512019.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387408/normal_6054b61bb11c6.pdfIn PDF document text
- http://zexaribamemavi.sportsontheweb.net/nipabinuzonaziwipifo.pdfIn PDF document text
- https://cdn.sqhk.co/nijusukelok/I7hfjge/lenovo_ideapad_l340-_15api.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424331/normal_6048f84271396.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443337/normal_5fd684f2c32a8.pdfIn PDF document text
- https://cdn.sqhk.co/kopilixa/cjha5ig/the_amazing_world_of_gumball_full_episodes_free.pdfIn PDF document text
- https://cdn.sqhk.co/rabovafom/gfitUEc/50068660270.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4451742/normal_5fe186b4a3b35.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379719/normal_6051c24c00c1e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4508cdbb-9c56-4d5a-a38c-7dfa8667492a/how_to_win_a_flush_in_poker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ccbf061c-fd9c-43da-a258-19ffe375aede/should_my_kidde_smoke_detector_flashes_red.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29912d1a-c832-4c0e-82ba-db11e31f7064/15783167184.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8049fc9-ca0a-4709-bd84-e012ccfd6d06/gifovudafizedivekoxaja.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77fa4fc7-14c0-4c07-8098-991bd9a16bee/how_to_reset_your_honeywell_alarm_system.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/26e25da8-93e9-4d7e-99e1-329f21713cb9/difference_between_sodastream_source_and_fizzi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5151097-9e62-4214-952a-fe0069e1ea8d/does_zoom_affect_internet_speed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85f315de-89ee-4c7b-9635-ab364a35a37f/the_giver_chapters_10-14_vocabulary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d68ddccf-c016-4e0f-ae8d-cf89cb9cdf3e/where_can_i_get_my_ged_for_free_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be0895c8-637c-44bb-a18a-e4ae101eb6b8/jesupexikedijiwi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e590.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE590 | 5168 bytes |
SHA-256: 4a232af391c10071c0215977e39dfe93ccfe58704fa631615281a9b7cdd07171 |
|||
font_01_sfnt_off0000f724.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF724 | 11560 bytes |
SHA-256: a834cdb916008c11b77a0118edecb3cbab13b1bd2402450aff00ffae8c7bff34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.