MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains numerous external URIs and is identified as a link farm hosted on disposable domains, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9372
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/aws?utm_term=who+is+the+strongest+god PDF link annotation
- http://umdtheatre.ru/safepunuguvoxeq7mmi.pdfIn PDF document text
- https://cdn.sqhk.co/dapumexader/MJqjiif/parler_app_social_media.pdfIn PDF document text
- https://cdn.sqhk.co/goxobuve/g7Xv7EL/81325861725.pdfIn PDF document text
- https://buzufurabobozu.weebly.com/uploads/1/3/5/3/135304208/vujaxojivapametaliz.pdfIn PDF document text
- http://supsun-aero.com/25579938335o3mf4.pdfIn PDF document text
- https://cdn.sqhk.co/pifizumux/aU3hKlf/8020868460.pdfIn PDF document text
- http://limons.space/how_to_take_your_permit_test_online_minnesota9vnxe.pdfIn PDF document text
- https://zelulugupu.weebly.com/uploads/1/3/3/9/133997406/4196411.pdfIn PDF document text
- http://esclub.pro/grand_pixel_royale_battlegrounds_mobile_battle_3d_apkpure119e5.pdfIn PDF document text
- http://immortal-sho.club/14759160335wcvbc.pdfIn PDF document text
- https://xufetujada.weebly.com/uploads/1/3/4/7/134745175/5751622.pdfIn PDF document text
- http://mrshadow.net/classifying_matter_find_the_hidden_image_answerqe94p.pdfIn PDF document text
- http://islta.fun/what_is_wilderness_first_aidnlgr5.pdfIn PDF document text
- https://doxemikawapuki.weebly.com/uploads/1/3/4/3/134314999/wefetir_dopupikova_tofujataru_zuvavabawuv.pdfIn PDF document text
- http://jobauthor.online/88830518084hj3jd.pdfIn PDF document text
- https://kelezisexuva.weebly.com/uploads/1/3/0/7/130739204/kufopitat_nedoregadera_wevenaja_woxoguvorozik.pdfIn PDF document text
- https://d6b7b3c7-8429-4d82-9d75-5d5d09e763cc.filesusr.com/ugd/a8c229_679e87c733e8438e983f2e6adf1d48d8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/penefelomiju/pusid.pdfIn PDF document text
- https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_7f51cd79fd3a4b5598627439b6bfb091.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tinajabizoreguf/66693828031.pdfIn PDF document text
- https://e590c0d9-b694-44fb-9862-47327b30d8b0.filesusr.com/ugd/89363e_1ea6a4f0f49643d19f562923851746c5.pdf?index=trueIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.