MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains heuristics indicating it's a phishing lure, specifically using an image to redirect users to an external URL. The embedded URL `https://gimoguvi.ru/strik?utm_term=thermo+king+alarm+codes` is identified as a potential phishing or malware distribution point. While no scripts were explicitly extracted, the PDF structure and the ML classifier strongly suggest malicious intent, likely related to phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/strik?utm_term=thermo+king+alarm+codes PDF link annotation
- http://lakcherie.ru/xobofanusajovarel8wdis.pdfIn PDF document text
- https://cdn.sqhk.co/fuluzagile/ehjhjey/stair_runner_carpet_pad.pdfIn PDF document text
- https://cdn.sqhk.co/sopiloroda/ZTtksp7/gloom_boom_doom_report_deutsch.pdfIn PDF document text
- https://cdn.sqhk.co/felolavap/jFpApje/christmas_hair_salon_memes.pdfIn PDF document text
- http://help-violation.com/29136860402oksdv.pdfIn PDF document text
- https://cdn.sqhk.co/zunesunatiri/igggfib/11383239709.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/votuweroxigezog/boss_ve_20_vs_tc_helicon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/810b6e46-7bbd-4389-8746-08aa5ae8c8c7/wumitunibef.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e26871e-721f-4129-9d58-fa5336750c74/jokiruwosiweboxoguda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f77d480d-43c1-44ad-9af7-8e732591808b/7803844666.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44693afa-4b43-4698-a482-15643bf28a0c/kujelusiruxafogi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/323a73bd-8ff0-4dba-8475-3b94de5c0af5/lekosuromagenabe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c1a76bc-b694-45e2-8cf2-84c6db014f36/81630605071.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/344b931d-9e3e-4612-b287-922cad5572da/what_does_your_handwriting_say_about_your_personality.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/925e98cf-87bf-413e-95a7-998d2c3eafc5/62614467288.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b50dc73a-76ad-47af-bae5-e8ec62c5ad20/80018417791.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09dc1f2f-8191-466d-93a8-06b708612aea/vupajaj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96aad613-d96a-4d8d-939a-b332a7e0c4a4/53462374434.pdfIn PDF document text
- https://s3.amazonaws.com/xujitezu/mike_meyers_video_course.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e172b41-6bbb-4f5a-bd4e-eb254920ef3e/mamubakolewome.pdfIn PDF document text
- https://s3.amazonaws.com/piwupevivotixi/38276746929.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f0f5c3a2-1527-4dc5-8598-cc7b08bffc17/what_rhetorical_devices_are_used_in_speeches.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000104e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104E1 | 5368 bytes |
SHA-256: e97c62ea920c07071ff8cda7dfb9cf8187447bf6c4e06c317f9a0e53dafb5831 |
|||
font_01_sfnt_off000116f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x116F0 | 11272 bytes |
SHA-256: 4b1731e0a12844a4973ad56ebde266fca827c1b49bc911e47db6d5c33fe16c01 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.