MALICIOUS
166
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.7309
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yubit.co.za/XSRYdR1H?utm_term=computer+acronyms+list+and+definitions+pdf PDF link annotation
- http://gezond-trakteren.nl/kasteel-doornenburg-img/bestandenfile/60160254685.pdfIn PDF document text
- https://buderenedisam.weebly.com/uploads/1/3/5/3/135302361/jaruzag-wedaj-fusefupaboxunej.pdfIn PDF document text
- https://egca.fr/userfiles/file/temekudikotefesowe.pdfIn PDF document text
- http://apart1day.ru/file/sejejexat.pdfIn PDF document text
- https://watosaphotography.com/app/webroot/userfiles/files/20220326_062820.pdfIn PDF document text
- https://xiligori.weebly.com/uploads/1/3/1/4/131411896/9069658.pdfIn PDF document text
- http://adm-zhemtala.ru/files/files/76525043820.pdfIn PDF document text
- http://chpcentre.com/files/file/85521863918.pdfIn PDF document text
- https://vasodekomupu.weebly.com/uploads/1/4/1/3/141375701/nafuv.pdfIn PDF document text
- http://www.atccs3.it/atccs3/fckeditor/editor/ckfinder/userfiles/files/46937418579.pdfIn PDF document text
- http://www.fashiongale.ro/userfiles/files/xipodomekarolazumetawuzuz.pdfIn PDF document text
- https://braus.uz/images/shared/file/89774568756.pdfIn PDF document text
- https://zegepefuloruwan.weebly.com/uploads/1/3/4/0/134012378/xibutakowu.pdfIn PDF document text
- https://mannerfeltdesignteam.se/ckfinder/userfiles/files/wegofopobatisisamapuw.pdfIn PDF document text
- https://suduwigopoda.weebly.com/uploads/1/3/4/5/134587425/bikonobu_dirujupi_febapeturo_sivufepej.pdfIn PDF document text
- http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1623874ce52572---72769475895.pdfIn PDF document text
- https://lonodoxelu.weebly.com/uploads/1/3/4/3/134305804/2f87a.pdfIn PDF document text
- https://www.bountyvacation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620d8c7f2a5ca---21823252564.pdfIn PDF document text
- https://relupopakamon.weebly.com/uploads/1/3/4/4/134455445/3737813.pdfIn PDF document text
- http://cadelupo.it/userfiles/files/bevixipozedanurimunajuju.pdfIn PDF document text
- https://tazeviguso.weebly.com/uploads/1/3/4/3/134339516/8286917.pdfIn PDF document text
- https://zelidewa.weebly.com/uploads/1/3/4/3/134371532/1333393.pdfIn PDF document text
- http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/162015d780f81d---bowamiduluxubalapukek.pdfIn PDF document text
- https://tetisawemovuzin.weebly.com/uploads/1/4/1/3/141328914/telomor.pdfIn PDF document text
- https://wlao.on.ca/wp-content/plugins/super-forms/uploads/php/files/121716cdd346cb0cec260f5160498462/75038800089.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005d1b2.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005d1b2.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0005d1b2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5D1B2 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0005e9c9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5E9C9 | 11024 bytes |
SHA-256: 819a5fd0159b4f6d5dcca59fef26188b43b58d717a4c26eab97ba861a877a9d1 |
|||
font_02_sfnt_off00060372.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x60372 | 18232 bytes |
SHA-256: d93c35e90f84e8d2e21c4a2c7a04b76a6e7f7cbfe2807b7ab8873e87286b7081 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.