MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link to a known malicious redirector, indicating an attempt to phish or deliver malware. The document body, though heavily obfuscated, appears to be a lure related to relationship advice. The ML classifier and ClamAV detection strongly support the malicious verdict.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=como+terminar+una+relacion+que+te+hace+da%25C3%25B1o In PDF document text
- http://xogezile.66ghz.com/how_to_become_a_cleric_5e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/nisiwanolom/sasedeliwedubig.pdfIn PDF document text
- https://3d7c42e8-cad9-4196-8f3c-0f210fd97588.filesusr.com/ugd/1b7c00_d2e5eec6f85d459bad1c0dbbf5531c16.pdf?index=trueIn PDF document text
- https://a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com/ugd/cf950b_2ccd6899c416415582e07666eaabb25f.pdf?index=trueIn PDF document text
- https://0296ecfc-28ae-4fa5-925c-67a25994cace.filesusr.com/ugd/c88839_17c21e8623044cc28dd176bd8f03999b.pdf?index=trueIn PDF document text
- https://5d3a3edc-1384-4eb0-a354-174dd54c13aa.filesusr.com/ugd/7f5dc5_08adfb5f994d4eccb79f86120a05f897.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/45b722ca-09fe-426f-972c-0b639cf95767/breadman_bread_machine_recipes__instruction_manual.pdfIn PDF document text
- https://s3.amazonaws.com/gurupixabogivaz/2512768041.pdfIn PDF document text
- https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_8fef32e298514a3ba4101e5d3a90c895.pdf?index=trueIn PDF document text
- http://xojorefalez.rf.gd/larixulenezoxirajoriw.pdfIn PDF document text
- https://67536400-2f23-40e2-9d3a-36ae3f4dfb8c.filesusr.com/ugd/5312ea_d33974b440b1454c99baacc99641fbbe.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f7a34a05-b9a7-475f-a057-eceea33b3de2/thinking_fast_and_slow_chapter_14_summary.pdfIn PDF document text
- http://zujexig.epizy.com/potojivevazikusujafiba.pdfIn PDF document text
- https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_9203702b07344d828fcea2f872cb2924.pdf?index=trueIn PDF document text
- https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_aeff5fd0cbb647e18840b8cc7948f421.pdf?index=trueIn PDF document text
- https://6cf80756-66c2-4d2e-b15d-ff1677cb7115.filesusr.com/ugd/2257e8_b36eb0bdd87d428497b54ef3e2f44525.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dutimajizowa/nezavurebokepaxekigopeso.pdfIn PDF document text
- http://vovodevugawas.epizy.com/listening_skills_worksheets_for_grade_1.pdfIn PDF document text
- http://gikutixutawax.epizy.com/fdcio222_siemens_datasheet.pdfIn PDF document text
- https://s3.amazonaws.com/dejolavubukugeb/zukinepifoborofuraro.pdfIn PDF document text
- http://puloxivomavari.epizy.com/panasonic_dmr-es15_reset.pdfIn PDF document text
- http://zetusemikaso.rf.gd/how_to_clear_error_codes_on_chamberlain_garage_door_opener.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ebfd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBFD | 5244 bytes |
SHA-256: 442a93f0194f88ff896b4c15a418f3cc5cc7a4c2205eaf1983ccabcccba5bcb9 |
|||
font_01_sfnt_off0000fd56.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD56 | 11792 bytes |
SHA-256: fc64c7b8eb2e1073579393a80f1dd2b8152dfc8397f49f3290cef81a83ea4c27 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.