MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains heuristics indicating it is a link farm designed to redirect users to external sites, with one specific URL suggesting a password reset lure. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or credential harvesting attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=reset+password+iomega+storcenter+ix2 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4408346/normal_5fe667070ca6f.pdfIn PDF document text
- http://igclienteam.com/94697629460fiavb.pdfIn PDF document text
- http://microdigitalmeter.xyz/fitobelelewekiglcxmn.pdfIn PDF document text
- http://byseles.xyz/wall_panelling72nja.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486745/normal_6001ae4aaca0d.pdfIn PDF document text
- http://zunuwapinab.iblogger.org/93863411143.pdfIn PDF document text
- http://helplnstagramoffice.com/schwinn_stationary_biken9srk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371790/normal_6014eae647131.pdfIn PDF document text
- http://connexion-amelii.xyz/spinal_cord_functionx43p4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4497344/normal_606e40c1bd52d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381531/normal_5fe76feac991d.pdfIn PDF document text
- http://gosezan.22web.org/15070426068.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_3def53fc785c453481856b1764a9b686.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8447c140-72a7-4fae-a045-fd7ca4692924/mechanical_project_engineer_jobs_in_australia.pdfIn PDF document text
- http://lorazak.epizy.com/place_value_worksheet_fifth_grade.pdfIn PDF document text
- https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_f7e302c1f84045c7b45e0d45c91e3513.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0e516432-44fa-47d1-8bca-daa28e7e80f1/45106326111.pdfIn PDF document text
- http://nafopafilor.epizy.com/la_douleur_marguerite_duras_gratuit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4e8d720-34f7-4344-9880-040e3282cfdb/cuanto_mide_3_8_de_pulgada_en_centimetros.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cf49fe50-d90a-49f6-a028-ad999bb7a929/spt_humidifier_filter_reset.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7e31053-6c73-438b-832d-b90a0cd8381b/68378223949.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f7a82d47-eeb0-49e1-9de5-569ffcba456d/jalukukomixelelivi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6415578-7cb4-446b-a41b-b9b4734d72df/vozewur.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28ef1218-ec20-4b14-b487-8e3040b080e6/52874306649.pdfIn PDF document text
- https://1c92f6d8-19eb-429c-9239-1cf6be91372f.filesusr.com/ugd/cc1a03_90890b1d08ce4e26a18f51737bd44dc6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f14b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF14B | 5660 bytes |
SHA-256: d3727f7d95cf533462ea3802d88d3547037cdf6a9c9f2629794c51cf9112d3bb |
|||
font_01_sfnt_off00010497.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10497 | 11020 bytes |
SHA-256: 039f4b06aae6ca9dbc85956e43fed47181c5ecb3e152f0913b6ec5cf0c6e363a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.