MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, indicating a malicious intent to redirect users. The ClamAV detection and ML classifier further support its malicious nature. The document body, though heavily obfuscated, suggests a lure related to 'al quran english version pdf' to entice clicks on these malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 0.6589
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/award?keyword=al+quran+english+version+pdf PDF link annotation
- http://tuderoba.getenjoyment.net/how_to_find_food_calories_per_gram.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470399/normal_603f3e027945b.pdfIn PDF document text
- https://cdn.sqhk.co/rikopekela/Sgchcg8/15642009297.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387928/normal_5fec0f156a415.pdfIn PDF document text
- http://derewopenila.22web.org/resident_evil_4_apk_obb_mod.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4456135/normal_60015fd841764.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426551/normal_601e6452b6e0d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416666/normal_6044720277f47.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495413/normal_6028c0afce64b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4379626/normal_5ff759dbc8c99.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369323/normal_6038776a40a88.pdfIn PDF document text
- https://cdn.sqhk.co/nezazexador/djohhge/world_war_z_crossplay_pc_and_xbox.pdfIn PDF document text
- http://tulusujubige.mygamesonline.org/15081285720.pdfIn PDF document text
- https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_d44f0b0a23424f30b4445bf6278a67d8.pdf?index=trueIn PDF document text
- http://dokudaruriwiv.atwebpages.com/yoga_breathing_exercises_for_asthma.pdfIn PDF document text
- https://8f20b4bd-83f7-4a55-8c6f-e9501e2e061c.filesusr.com/ugd/c1c462_76b8e45f4ea24adf840bc8aa2a6eec06.pdf?index=trueIn PDF document text
- https://f50ece36-1901-4a7b-9396-968a400df7f4.filesusr.com/ugd/3ecb95_1479db7e6bec409c91e128213851a130.pdf?index=trueIn PDF document text
- http://joboberunora.rf.gd/vugexiputagux.pdfIn PDF document text
- https://dc273c12-e125-4738-b2e6-b96bc4bd5eb7.filesusr.com/ugd/c8df25_36760da0ae634106b5fe52c0fa71eed2.pdf?index=trueIn PDF document text
- http://beninoduvewer.epizy.com/number_6_worksheets_kindergarten.pdfIn PDF document text
- http://gerabar.epizy.com/30294981069.pdfIn PDF document text
- http://vomajifinudunu.epizy.com/notixu.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.