MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers as malicious. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading further malicious content or phishing for information. The document body, though heavily obfuscated, suggests a lure related to synonyms and antonyms, which is a common tactic for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/award?keyword=best+synonyms+and+antonyms+pdf PDF link annotation
- https://cdn.sqhk.co/wusakituzu/sihghsR/27931680212.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367281/normal_6052bffd98d02.pdfIn PDF document text
- https://cdn.sqhk.co/moserusoba/jd8ghhs/vobafulabu.pdfIn PDF document text
- https://cdn.sqhk.co/lafixafif/gdXhcj1/86999773272.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4476782/normal_5ffbcf155cc56.pdfIn PDF document text
- http://penexej.mywebcommunity.org/water_pollution_2020.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486350/normal_5fc69dbd6f599.pdfIn PDF document text
- https://cdn.sqhk.co/bijukipuj/ijAAjea/50676680405.pdfIn PDF document text
- https://cdn.sqhk.co/xororofomed/UgffHK1/724_insure_pantip.pdfIn PDF document text
- http://bosemefawixuwov.mypressonline.com/47765689828.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/ceadc11f-0fa2-4195-b922-1195c96dfd2c/perimeter_of_regular_shapes_worksheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6ac71d2-2b4d-4bb4-a436-c4e387314299/asus_dsl-ac68u_reset_button.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3fe18d02-11cb-4e9f-bbf3-77806d056719/marvel_comics_female_characters_names.pdfIn PDF document text
- http://guradewididexep.epizy.com/adwords_fundamentals_certification_exam_answers.pdfIn PDF document text
- http://biwosagamivi.myartsonline.com/did_lord_of_the_rings_return_of_the_king_won_eleven_oscars.pdfIn PDF document text
- http://gikunipif.epizy.com/vidmate_for_iphone_6_free.pdfIn PDF document text
- http://puzenufamem.rf.gd/examples_of_verbal_communication.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/556f4a4a-7bb5-4d25-84dd-509bd546181e/what_questions_to_ask_an_internship_interview.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ef68500-5318-4be8-b197-27ecde7fc64c/golezusasegajusugeviji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46378eed-2f80-4766-ba80-7b0346df3c0f/what_is_considered_a_notebook_computer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1bc8e905-f29d-42f6-89ef-f58f90f40a28/xenezefezu.pdfIn PDF document text
- http://pigutun.myartsonline.com/xixodanosatilur.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eead.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEAD | 5208 bytes |
SHA-256: bfa97763186ea499a91bb15c990ac9869834a068475a610b462785d26e8eb9fe |
|||
font_01_sfnt_off00010061.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10061 | 10308 bytes |
SHA-256: 8a4291fc749e542829e0f0dc4c90a9d3e8e3e8a88dc7c60c70778f6335fa9740 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.