MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by multiple heuristics as a credential phishing lure. It contains external URIs pointing to redirectors and potentially malicious domains, including one that impersonates a brand. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to steal user credentials.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://sexozubo.weebly.com/uploads/1/3/0/7/130740033/85853.pdf.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=how+to+predict+velocity+in+agile PDF link annotation
- http://idealica-it.website/samsung_galaxy_s5_active_clear_casestuecn.pdfIn PDF document text
- https://sexozubo.weebly.com/uploads/1/3/0/7/130740033/85853.pdfIn PDF document text
- https://texotawumixiwaw.weebly.com/uploads/1/3/4/8/134898612/jaloni.pdfIn PDF document text
- https://dolojimopa.weebly.com/uploads/1/3/4/8/134887070/2115574.pdfIn PDF document text
- http://magnitoli-2ekran.site/4807341697dw1l4.pdfIn PDF document text
- http://diletemofuvufu.22web.org/85948361248.pdfIn PDF document text
- http://aycotoro7.xyz/how_to_find_your_piriformis_musclemu91w.pdfIn PDF document text
- http://antileqphh.site/79206604372f4acv.pdfIn PDF document text
- http://rodina38.ru/62539855867fjszv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://ddb0fe67-a09a-413d-b59a-c21b1dde3186.filesusr.com/ugd/3f0e57_e0c1607768d547d088fb04b87335b7f1.pdf?index=trueIn PDF document text
- http://xanomake.epizy.com/gone_with_the_wind_summary_in_hindi.pdfIn PDF document text
- https://s3.amazonaws.com/lazolu/carcinoma_cervical.pdfIn PDF document text
- https://s3.amazonaws.com/jepinebawo/how_to_report_a_drug_crime_anonymously.pdfIn PDF document text
- http://kesibesezusede.rf.gd/5205377351.pdfIn PDF document text
- https://s3.amazonaws.com/vipinib/the_company_of_wolves_angela_carter.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a6ee56f-43f6-4d06-ae3b-2bea75113edf/local_area_network_lan_speed_testing_software.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81e56853-bd6d-4fb4-ab21-fdc7a63f8cd9/84106123705.pdfIn PDF document text
- https://7095e710-59ac-4d27-8a5a-f3bbcaf65deb.filesusr.com/ugd/418e76_1328e10d9d374bd0bd3f317afa0dd908.pdf?index=trueIn PDF document text
- https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_f7bc09b9519648318f0445bf63200258.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/27fd556a-524f-4810-951e-414328014c6f/group_theory_best_book.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/551c681f-69e0-4589-9119-3d3f4222295f/dyson_dc44_animal_parts_ebay.pdfIn PDF document text
- https://s3.amazonaws.com/miledu/dfbguide_face_reveal.pdfIn PDF document text
- http://napipipazapuka.epizy.com/4934305537.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e562.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE562 | 5068 bytes |
SHA-256: e4627caf29b8e183e0aa49540e58d7dcab7696660b39812ac1e43c7c5791946d |
|||
font_01_sfnt_off0000f6c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6C1 | 10300 bytes |
SHA-256: eb92f6fdd306b5c0daa13220d90c26c9834cb33fe0fac616797987b88be20efa |
|||
font_02_sfnt_off000119ff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x119FF | 4324 bytes |
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.