MALICIOUS
126
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.9770
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://arbormaster.us/uploads/files/93193861573.pdf In PDF document text
- http://rosspeed.com/kcfinder/upload/files/35847201006.pdfIn PDF document text
- http://bernievet.ro/kcfinder/upload/files/67339705004.pdfIn PDF document text
- http://constantemail.com/userfiles/file/1643697255figimukuzitopokazejob.pdfIn PDF document text
- https://gicz.jp/uploads/kc-uploads/tmp/files/kexapatewelabaropakefa.pdfIn PDF document text
- http://5lovestartw.com/CKEdit/upload/files/30000610628.pdfIn PDF document text
- http://songchanraccomposite.com/upload/files/13251982162.pdfIn PDF document text
- http://associazionemillesogni.it/userfiles/files/62875506987.pdfIn PDF document text
- http://tsuyopillar.com/assets/kcfinder/upload/files/92915905400.pdfIn PDF document text
- http://vaynhe.com/upload/files/nedevukobemokekaw.pdfIn PDF document text
- https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/16b1b02b778cbe1163ea8f61238b811b/12739677932.pdfIn PDF document text
- http://bm-shower.com/userfiles/files/89469521392.pdfIn PDF document text
- http://hafrchamber.org.sa/ckeditor/kcfinder/upload/files/rokavaf.pdfIn PDF document text
- https://krantiservice.com/ckfinder/userfiles/files/42068897202.pdfIn PDF document text
- http://furasskutat.hu/admin/kcfinder/upload/files/51210402453.pdfIn PDF document text
- http://sspvjd.com/FileData/ckfinder/files/20220210_CCD867F46599238E.pdfIn PDF document text
- http://creptiles.dk/userfiles/file/jijitenapebexevim.pdfIn PDF document text
- http://nandnee.com/admin/ckeditor/kcfinder/upload/files/22276692460.pdfIn PDF document text
- https://www.ssemusic.com/kcfinder/upload/files/2121195594.pdfIn PDF document text
- http://www.donkersmontage.nl/kcfinder/upload/files/wowovitezomegepez.pdfIn PDF document text
- https://al-farh-iq.com/upload/userfiles/file/67328358729.pdfIn PDF document text
- http://a2kat.ru/userfiles/file/solumorumawejoxowin.pdfIn PDF document text
- https://festacontinua.it/public/file/56446826649.pdfIn PDF document text
- https://bsff.com/kcfinder/upload/files/57317752623.pdfIn PDF document text
- http://papinchess.ru/userfiles/file/19373880229.pdfIn PDF document text
- http://kielcenoca.pl/files/file/jetufepajimak.pdfIn PDF document text
- http://clevio.biz/fckUpload/file/lujinakewodugi.pdfIn PDF document text
- http://www.alcera.ca/userfiles/file/72599449781.pdfIn PDF document text
- http://todaystravel.com.tn/kcfinder/upload/files/76680511755.pdfIn PDF document text
- http://hagelkonzept.de/userfiles/file/89603125948.pdfIn PDF document text
- https://rioclaro.com.co/kcfinder/upload/files/rufipenumedosemurenababiz.pdfIn PDF document text
- http://master-stroi76.ru/userfiles/file/pifasowipade.pdfIn PDF document text
- http://mebelhotel.ru/images/news/file/vutafuf.pdfIn PDF document text
- http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/1622b2a9623b9f---letikifevopimasesi.pdfIn PDF document text
- https://demo-calson.garment-pro.com/ckfinder/userfiles/files/vunisojolilixuge.pdfIn PDF document text
- https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/161ffd1ce90d7b---13137078951.pdfIn PDF document text
- http://partiaweb.com/upload/files/50060212466.pdfIn PDF document text
- http://www.banzolaassociati.com/gestlab/kcfinder/upload/files/mobelawexugarugetowuxub.pdfIn PDF document text
- http://demenagements-remond.fr/userfiles/file/20220218052653.pdfIn PDF document text
- https://dacinsara.ro/fckfiles/file/zebawo.pdfIn PDF document text
- https://semineebrasov.ro/printuri-fi/files/nenigidimawe.pdfIn PDF document text
- http://travelsolutions.co/ckeditor/kcfinder/upload/files/86978301465.pdfIn PDF document text
- http://geoscan.it/userfiles/files/kolivakexenawibepek.pdfIn PDF document text
- http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/1621d8f935c1d1---mavigosumowili.pdfIn PDF document text
- https://nitm.ac.in/nitmeghalaya/ckfinder/userfiles/files/wagom.pdfIn PDF document text
- http://ttech.com.vn/ckeditor/kcfinder/upload/files/pamexemutefibikib.pdfIn PDF document text
- http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/16215f7a6996a7---loboloziwifazimediwexiz.pdfIn PDF document text
- https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/24c6d8214de70b6c2e06e46e38640420/47677420281.pdfIn PDF document text
- http://hipscycle.simplywebeditor.com/site-uploads/22234282792.pdfIn PDF document text
- http://ucg-eg.com/userfiles/file/49293838855.pdfIn PDF document text
+9 more URL(s)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cb3f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCB3F | 20284 bytes |
SHA-256: 53ff68308d9ffff4700782ae6b47b891ce856ab390301e35d4a265bc92674179 |
|||
font_01_sfnt_off00010097.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10097 | 11124 bytes |
SHA-256: 7e4e4313b48b6bd38f5e698dff53bef1581c66a2b6fe26d0e7b90d0a969d8380 |
|||
font_02_sfnt_off00011a18.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A18 | 16336 bytes |
SHA-256: adf38969d40f501586e0caf93d33991e243baeeecfe575c4831cdbf64b7044fa |
|||
font_03_sfnt_off0001301a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1301A | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.