MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including a high-confidence ML classifier and ClamAV, indicating malicious intent. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic and the presence of numerous embedded URLs suggest a phishing or malware distribution campaign. The document body, though heavily obfuscated, contains references to microeconomics and appears to be generated by wkhtmltopdf, a tool often used to create PDF documents from web content, further supporting the lure-based attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/aws?utm_term=what+is+microeconomics+explain+the+features+of+microeconomics PDF link annotation
- https://cdn.sqhk.co/nasubivapu/Ughjehf/15836639753.pdfIn PDF document text
- https://cdn.sqhk.co/voguzasijur/eLvBs91/dojug.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450045/normal_5fe7081306801.pdfIn PDF document text
- https://nofixemi.weebly.com/uploads/1/3/6/0/136082439/386910.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470979/normal_6025105f5b7c9.pdfIn PDF document text
- https://cdn.sqhk.co/xolovagi/SbP39ii/raspberry_pi_3_pinout_power.pdfIn PDF document text
- https://cdn.sqhk.co/bebomopakax/hfhfQSs/metrotex_dallas_classes.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383698/normal_6010d4293d00d.pdfIn PDF document text
- https://lareduna.weebly.com/uploads/1/3/1/4/131453109/b8073a095.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418000/normal_604d916b0e234.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426955/normal_5ff59c7dc95e7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://gekekuvowu.epizy.com/is_2021_going_to_be_a_good_year_for_capricorn.pdfIn PDF document text
- https://s3.amazonaws.com/toliwudalamem/tafutuguwinokoji.pdfIn PDF document text
- https://s3.amazonaws.com/kezemiradigu/bhaigiri_full_movie_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac344447-fa13-48ba-864f-43de6bea5acf/nc_drivers_license_practice_test_printable.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cc2419f9-f20d-441d-9179-de5767fb74d7/53013080132.pdfIn PDF document text
- https://s3.amazonaws.com/dibedamoka/85709906786.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/477ac427-10de-4422-b8c1-b17a1d3b2602/gidanaxoverazezusaxisapa.pdfIn PDF document text
- https://s3.amazonaws.com/likerajatob/jujinofut.pdfIn PDF document text
- http://kevakop.epizy.com/sanixulexo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b13da39-9be5-4fe3-902d-4a1ff9df034f/mi_maestro_el_cientfico_estaba_feliz_de_que_yo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ebfe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBFE | 5216 bytes |
SHA-256: d053a196572c99effc98ff1ad1cc197571adb4df0a6b9f31e7ce2152478cbb93 |
|||
font_01_sfnt_off0000fda0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDA0 | 11016 bytes |
SHA-256: aa5888e854e4275aa526d85756d23968cd6e7e19d26f3ba3b8ff9e97749b7400 |
|||
font_02_sfnt_off00012308.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12308 | 16060 bytes |
SHA-256: d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7 |
|||
font_03_sfnt_off000137a0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x137A0 | 4324 bytes |
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.