MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics, including ML and ClamAV, as malicious and a phishing attempt. It contains an embedded URL that redirects to a suspicious domain, likely intended to lure users into downloading further malware or engaging in phishing activities. The document body, though heavily obfuscated, appears to be a lure related to 'film trivia questions'.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/123?utm_term=film+trivia+questions+and+answers+2016 PDF link annotation
- http://ludshop.xyz/sobovijafavuxezalib78k5v.pdfIn PDF document text
- http://pressit.space/jevijafomowusulagutajon284fq.pdfIn PDF document text
- http://mushygushysayings.com/software_developer_in_test_salary_canadav04bm.pdfIn PDF document text
- http://healthytrands.com/8700798460118gyl.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://044e8d80-c429-4a1f-820d-9b443c65b389.filesusr.com/ugd/53c654_a7982bc4e62c4ad2b269aa2ee02961e7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lixasifasi/39813396019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4df16df1-af37-4724-91d7-9bb42de9db3c/how_to_download_ms_excel_2013.pdfIn PDF document text
- https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_5c6d1634393e465984afaf218e8980e5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nabifovu/bovine_spongiform_encephalopathy_vs_encephalitis.pdfIn PDF document text
- https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_1682ebe2ce494482900851aecfaef76d.pdf?index=trueIn PDF document text
- https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_dbb29877edd64ecb9f9bbde06a2545cb.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nitidadufetenu/31090555156.pdfIn PDF document text
- https://s3.amazonaws.com/bewibiwat/rurezoloroz.pdfIn PDF document text
- https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_993dd0ddb71d49b9b463d3ba3d2f19a8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/df09af60-96fe-49c4-8f17-d21e6d7fe387/dusk_till_dawn_piano_sheet_music_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bce606af-78dc-4fdd-83a5-536d227b165c/tipos_de_esquemas_electricos_unifilar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/43ef96b1-41d8-4691-b54e-0c5be26ce615/6177645805.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a06f124-1f2e-4ce1-b647-0244aaaf16fd/xeratajinerada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/521aa19a-e999-41fa-bed4-f5544af8efc2/lean_six_sigma_tutorial.pdfIn PDF document text
- https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_b50ea7f9df984a16a33c461e1c59f670.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vosimalume/chongqing_metro_map.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ede2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDE2 | 5568 bytes |
SHA-256: b81ce3576f41f057cda06bba50c272eea2c30748945cdbe2164a002e4bd6bdff |
|||
font_01_sfnt_off000100c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100C2 | 11552 bytes |
SHA-256: 802c4da9601f424f733ec50f972d4529eefe65520f403c2630b8d28e9af1c8ac |
|||
font_02_sfnt_off00012815.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12815 | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.