MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI and an SEO redirector link pointing to 'https://soxebez.ru/award?keyword=a+handbook+of+creative+thinking+techniques+pdf', which is designed to trick users into downloading a file under the guise of a free handbook. No scripts were extracted, but the PDF structure and embedded URLs strongly indicate a phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9967
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/award?keyword=a+handbook+of+creative+thinking+techniques+pdf PDF link annotation
- https://static.s123-cdn-static.com/uploads/4381737/normal_5fff22511010b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415546/normal_603b3530c4cb2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460706/normal_602c97c5b7370.pdfIn PDF document text
- https://cdn.sqhk.co/pesuxitum/gejbgi1/puvujug.pdfIn PDF document text
- https://cdn.sqhk.co/luginuwi/erNy3ij/grammar_exercise_determiners_worksheets.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492536/normal_6012267481fac.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4452169/normal_5fd34b9900aaa.pdfIn PDF document text
- https://cdn.sqhk.co/perikowep/izMDlgf/zaferuzosonurom.pdfIn PDF document text
- https://cdn.sqhk.co/rotonoba/ISgddBA/mtv_rock_heroes_weekend_playlist.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/susonanezaj/entrepreneurship_development_textbook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f287fe8c-3382-4c2d-8908-2926b0f366a1/how_to_use_a_woodturning_lathe_machine.pdfIn PDF document text
- https://s3.amazonaws.com/rorives/n1_mathematics_books.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e48796de-ffbd-4b7b-a02b-82a352728b91/black_and_decker_grass_hog_battery_trimmer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee617845-8452-45fe-adbd-9e7d5110434f/effective_telephone_communication_includes_quizlet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c86f0d6e-1232-4e19-9198-ffa68afb24b6/what_is_the_warranty_on_a_badger_garbage_disposal.pdfIn PDF document text
- https://s3.amazonaws.com/moduxanakuri/how_to_connect_two_boards_together_side_by_side.pdfIn PDF document text
- https://s3.amazonaws.com/zagubip/nojez.pdfIn PDF document text
- https://s3.amazonaws.com/loneminovu/gutuwudotavefo.pdfIn PDF document text
- https://s3.amazonaws.com/gapuruxumeg/factorization_practice_worksheets.pdfIn PDF document text
- https://s3.amazonaws.com/nademopor/37808975140.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b9a8b66-6893-4630-8fbb-86fe4d96ad2b/how_to_change_cutting_blades_on_husqvarna_riding_mower.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a42004db-66c6-43d9-b0ea-572371450897/washington_dc_weather_underground_10_day.pdfIn PDF document text
- https://s3.amazonaws.com/xarojapi/visual_cv_templates_free_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc49b006-60a9-415d-a67a-ad024ae858d7/what_does_bq_mean_on_power_supply.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4f883238-274f-48d6-a7d9-4a61419ebdc5/508448307.pdfIn PDF document text
- https://s3.amazonaws.com/lezopobigeza/wozimekaduxozafikuxegus.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f6f5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6F5 | 5764 bytes |
SHA-256: bae78ff8b3fba356657ae2b0a5025c87569bc06615fa67e5cf8365ff9d88abe5 |
|||
font_01_sfnt_off00010a87.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A87 | 14236 bytes |
SHA-256: 5efbebc26f0732491feb60d636167ebf255438fb707e6e0cd745f2c62cd29baf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.