MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF document employs a common phishing tactic by using SEO-optimized redirector links, such as http://urseghy.com/c3?utm_term=how+to+restore+gallery+photos+on+android, to lure victims into downloading further malicious content. The heuristic 'SE_TRAVEL_SUPPORT_PHONE_SCAM' indicates the document is stuffed with phone numbers, likely to impersonate a support service and trick users into calling, thereby facilitating social engineering. While no scripts were directly extracted, the PDF structure and embedded URLs suggest it acts as a downloader or redirector for a second-stage payload, justifying the use of T1059.007 and T1203.
Machine Learning
- Nyx PDF Classifier malicious score 0.5331
Heuristics 5
-
Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAMDocument repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ydt.youtuweb.cn/a/comimg/20220527215626_9085.pdf In PDF document text
- http://fazendasaojudastadeu.net/fotosempresa/files/xunojujebefaresosuzube.pdfIn PDF document text
- https://wetuwisiw.weebly.com/uploads/1/3/4/4/134495793/nusovosef_nidudi.pdfIn PDF document text
- http://xn----8sbkebltdkywd.xn--p1ai/ckfinder/userfiles/files/boveneletodifi.pdfIn PDF document text
- https://segufoto.weebly.com/uploads/1/4/1/7/141740386/4fbf65ff7660366.pdfIn PDF document text
- https://mutakisutuw.weebly.com/uploads/1/3/4/7/134768563/waludemi-zanebuxuwi-dikevulameliz.pdfIn PDF document text
- http://pkpneu.cz/userfiles/file/78634223544.pdfIn PDF document text
- http://xn--9d0bk1sn6gncq95flql.net/user_data/kcfinder/files/27247966466.pdfIn PDF document text
- http://hacsbathtarntaran.org/~/userfiles/file/xezedozunimekisiliwuna.pdfIn PDF document text
- http://ociretailcomputersciences.com/file_space/files/gubujujedabij.pdfIn PDF document text
- http://udmvdpo.ru/images/files/56399315056.pdfIn PDF document text
- https://pefojakewire.weebly.com/uploads/1/4/2/1/142176073/dbb00d668d48c.pdfIn PDF document text
- http://urseghy.com/c3?utm_term=how+to+restore+gallery+photos+on+androidPDF link annotation
- https://dewajijivixire.weebly.com/uploads/1/3/4/6/134638152/4b58a.pdfIn PDF document text
- https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e4aec35504097401ce4598/1659154116421/xaguwuravuwokavuro.pdfIn PDF document text
- https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c005402406b51d529e90e6/1656751425123/digimon_cyber_sleuth_chapter_6.pdfIn PDF document text
- https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c0ae13811d3b6056ac5638/1656794644363/zowafazetodero.pdfIn PDF document text
- https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e2ba8c9f05250506fffeb4/1659026060496/60994728251.pdfIn PDF document text
- https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62d8dcb82c1b1c4ad1431bf1/1658379449097/jennifer_lopez_true_love.pdfIn PDF document text
- https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c89818050ff510773bb443/1657313304765/descargar_crash_nitro_kart_para_pc.pdfIn PDF document text
- https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62ca94494b5596786d9c315c/1657443402505/pagojenugeganuwikumijufib.pdfIn PDF document text
- https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e1d1da9941e677559e4bd9/1658966491101/arabic_font_for_android_keyboard.pdfIn PDF document text
- https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62e518ddc898ce7096a788ca/1659181277590/tegipivitetus.pdfIn PDF document text
- https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62e1a6645dcf7b32675c3ca5/1658955364872/57876006076.pdfIn PDF document text
- https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62e0e21faaea29098fa52a2e/1658905120013/lab_report_introduction_template.pdfIn PDF document text
- https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62c4d7f4a3e32f6b59506b5d/1657067508683/setaluvalutarexevosaxi.pdfIn PDF document text
- https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c9d942b848172a2844a6bd/1657395522371/density_times_height_times_gravity.pdfIn PDF document text
- https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62cb712f6a3d6b58b3d15b1e/1657499951580/paragon_ntfs_for_mac_free.pdfIn PDF document text
- https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c3a3f6d7e1be611f974e85/1656988662477/suprabhatam_mp3_free_download_ms_sub.pdfIn PDF document text
- https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62b8e7976bc8b546ca22bc72/1656285080330/what_do_pentecostals_wear_to_bed.pdfIn PDF document text
- https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62bd79507c73fc4b909c3680/1656584528888/nedensel_karlatrma_aratrmas.pdfIn PDF document text
- https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62dfeb42be7a2d030b587576/1658841922637/90751759851.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00067f65.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00067f65.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00067f65.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x67F65 | 18164 bytes |
SHA-256: 0670a0536800d518306be3ff461f27e209e01db5a20f8d73319d7d46138a3eae |
|||
font_01_sfnt_off0006aeaa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6AEAA | 10864 bytes |
SHA-256: b8a6c99a3a9e7ca58822e1fa5aac787ffbeaeeade859861b19535107a40646d9 |
|||
font_02_sfnt_off0006c782.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6C782 | 1720 bytes |
SHA-256: c0b933cc36cba842119de089e39250053550c328e9a64bb771c85107c4445ff8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.