MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of embedded URLs, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'Qt', indicating it was likely generated by a tool rather than a standard document editor, further supporting a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=do+you+have+to+be+a+certain+height+to+be+a+navy+seal PDF link annotation
- https://cdn.sqhk.co/fujalapevame/coibidO/femesodenajalemadux.pdfIn PDF document text
- http://kenugizi.getenjoyment.net/does_cox_cable_offer_newsmax.pdfIn PDF document text
- http://kifopelidito.mypressonline.com/gokopotinorimurabalojigu.pdfIn PDF document text
- http://vevaroda.scienceontheweb.net/wivibegexugemaxuwad.pdfIn PDF document text
- http://vafakewa.iblogger.org/financial_literacy_chapter_7_test_answers.pdfIn PDF document text
- http://mumijivamivaxij.medianewsonline.com/zudugadiw.pdfIn PDF document text
- https://cdn.sqhk.co/xidizizo/7BQg5ia/bitafidunapewanuraxoki.pdfIn PDF document text
- http://paxezot.getenjoyment.net/boundary_conditions_for_magnetic_field.pdfIn PDF document text
- https://cdn.sqhk.co/surofowudula/agde2gc/30003768512.pdfIn PDF document text
- http://zekojotewakugag.mypressonline.com/90919283774.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cd489911-dc6d-4439-b408-84622343fb93.filesusr.com/ugd/d8e941_b17b0fa350014aa7bbc831a259912efe.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1382d380-4a77-4119-93b4-385edbc095fb/wunujiboxu.pdfIn PDF document text
- http://rixigor.onlinewebshop.net/47253699566.pdfIn PDF document text
- https://ef4b221f-cfb4-47e8-bf1d-3b5092770df7.filesusr.com/ugd/4948da_4fd8d7818b4c4b84aa15e737d730e1eb.pdf?index=trueIn PDF document text
- http://kofaxafogi.myartsonline.com/how_to_use_the_samsung_remote_control.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/994ff5fa-6686-4fce-8e9a-96e3948ef0bb/what_does_it_mean_when_a_hawk_looks_at_you.pdfIn PDF document text
- http://dimufinafez.rf.gd/advertising_english_lesson.pdfIn PDF document text
- http://juborekif.atwebpages.com/guzodaxeziva.pdfIn PDF document text
- https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_3d1e738c9bb44ff5bbcf5b1d01ad93ca.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ae4bf593-bb9e-4bce-82a8-7105f8819117/red_harvest_magnificent_seven_face_paint.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90d00eb4-57ec-4adc-b0e5-08ba2f3a5a92/korg_x50_synthesizer_used.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ebca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBCA | 5364 bytes |
SHA-256: 08c541573cce21ae994c7ed81eb468a11a3bc8114eaee59e88a3477912c532fd |
|||
font_01_sfnt_off0000fe16.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE16 | 10732 bytes |
SHA-256: 78bc1eeb0b88ec4cd6dd3ecfcfc9a64f9da0ba67665ce7f940a397f0d6dc2dc4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.