MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link to a known malicious redirector, identified by multiple heuristics and ClamAV detection as a phishing or trojan distribution attempt. The document body, though heavily obfuscated, contains text related to 'lrfd bridge design' and the wkhtmltopdf application, suggesting a lure to entice clicks on the malicious URL. No scripts were extracted, but the presence of malicious links and the ML classifier output strongly indicate a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/strik?utm_term=what+is+lrfd+bridge+design In PDF document text
- https://cdn-cms.f-static.net/uploads/4465565/normal_603ea7637fc3c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445333/normal_600db7c156a61.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366957/normal_602fcc9cb19ff.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4478422/normal_5fcf5237d0795.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4404528/normal_5ff257f9727fc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369179/normal_6024708b26ed3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476434/normal_6022696dcdb15.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/pibajuwi/xanolavozugi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/985911c4-f3fb-4f94-b9e4-60ffd341f808/spoken_english_book_in_hindi.pdfIn PDF document text
- https://s3.amazonaws.com/dedinavesute/54432281952.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bcf8a223-a317-4035-9bee-0e1899244cea/54633949434.pdfIn PDF document text
- https://s3.amazonaws.com/gebukil/5469186416.pdfIn PDF document text
- https://s3.amazonaws.com/bejokazemur/accel_world_light_novel_fr.pdfIn PDF document text
- https://s3.amazonaws.com/tunenijexe/curb_your_enthusiasm_theme_song_sheet_music.pdfIn PDF document text
- https://s3.amazonaws.com/kotidox/kuvugusitumufiwexipoxas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77622e8e-6403-4cfe-948c-93020b36c98d/how_much_does_it_cost_to_get_a_new_exhaust_system.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a78d6251-ba7f-4a81-b7bf-e031341b8781/gramatica_espaola_avanzada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9425667a-8117-40b3-a805-9e45a1343ef1/how_to_earn_online_by_solving_maths_problems.pdfIn PDF document text
- https://s3.amazonaws.com/nonipesikiri/how_to_clean_a_krups_coffee_maker.pdfIn PDF document text
- https://s3.amazonaws.com/wujapu/amharic_fiction_book_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc469b1d-24f8-4885-839d-cdfb3f15ec70/which_is_better_fundamental_analysis_or_technical_analysis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e046dfa4-d7e2-46de-8ca7-6bf98a81cbbc/statics_and_mechanics_of_materials_bedford_fowler_liechti.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d7ee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD7EE | 5000 bytes |
SHA-256: 0567cc33c03277820f5902a44ba831d25bb626976aae27ce4bfbdc1201be39f8 |
|||
font_01_sfnt_off0000e8e9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8E9 | 10864 bytes |
SHA-256: 1d4a56acb39772f00a60ebfbb8177d892bd39f9792e3b54c317054a2f9cf1a09 |
|||
font_02_sfnt_off00010df8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DF8 | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.