MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with one specifically pointing to a suspicious domain ('lozipotod.ru') that is likely used for phishing or malware distribution. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for link farms, further suggesting malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a malicious document designed to redirect users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9982
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=merchant+of+venice+perfume+red+potion PDF link annotation
- http://sudebatuwilazet.iblogger.org/betikivivomepiguk.pdfIn PDF document text
- https://cdn.sqhk.co/guvawatuzax/Yv1yje3/togonagusaz.pdfIn PDF document text
- https://cdn.sqhk.co/novitovikor/g4Blj7L/the_last_blade_2_move_list.pdfIn PDF document text
- http://20970907.net/area_of_compound_shapes_with_triangles_worksheetfyqtd.pdfIn PDF document text
- https://cdn.sqhk.co/zisubiziwu/haiihcM/parafojokesejer.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4419645/normal_5fe3f7b17ce97.pdfIn PDF document text
- http://ampinternational.org/systems_of_linear_equations_worksheet_answer_keykmt50.pdfIn PDF document text
- http://prizinsta24.space/schema_boite_a_fusible_transporter_t41bdyd.pdfIn PDF document text
- https://cdn.sqhk.co/rewaloxuruvu/gigffKq/best_streaming_apps_for_android_tv_box_2019.pdfIn PDF document text
- http://kismyketio.com/66872954244dza34.pdfIn PDF document text
- https://cdn.sqhk.co/bufudoraxala/vjcpUjh/lord_jesus_jigsaw_master_art_puzzles.pdfIn PDF document text
- https://cdn.sqhk.co/medujebukoma/hfhegg7/fobiwozubajumoxi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366347/normal_5fdb86276ef05.pdfIn PDF document text
- https://cdn.sqhk.co/dikapagoloza/Ogedw3a/72079273857.pdfIn PDF document text
- https://cdn.sqhk.co/wemopizajazo/jehhsib/plants_vs_zombie_heroes_apkpure.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/buponuwebi/wowenolepijesiwizudefepid.pdfIn PDF document text
- https://s3.amazonaws.com/liwafo/hp_officejet_8600_printer_-_ink_system_failure_error.pdfIn PDF document text
- http://vujofif.epizy.com/why_my_hyundai_sonata_wont_start.pdfIn PDF document text
- http://kenasaxoxaxober.rf.gd/the_horse_and_his_boy_book.pdfIn PDF document text
- http://kibowetesuve.rf.gd/bazaar_hd_movie_2018.pdfIn PDF document text
- https://s3.amazonaws.com/jenisozazewubo/wixareriko.pdfIn PDF document text
- https://s3.amazonaws.com/bawalidamovidud/zosedupobasonifo.pdfIn PDF document text
- http://sonekefe.epizy.com/internal_audit_interview_questions.pdfIn PDF document text
- https://s3.amazonaws.com/zebarufuridorur/20615393970.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off000146b9.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x146B9 | 26612 bytes |
SHA-256: c1679c5b923c5ab7b329314cb492e8f57650a3c2615b914c3d87760c87ad76a4 |
|||
font_00_sfnt_off0000f9ec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9EC | 3384 bytes |
SHA-256: f847ffde26dc8373df5baa9dfcea080e61ddcab87922d46ce90ea150d67312d3 |
|||
font_01_sfnt_off000105ff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105FF | 5248 bytes |
SHA-256: e3db931d0348cb7ec833245e4b530c77c20c8589280b273155abef88746d2fdf |
|||
font_02_sfnt_off000117c7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x117C7 | 16444 bytes |
SHA-256: c34e9aa5a6e9882c372f1b9b8de5088e1541bae0d8517677b7231b0fc73572ce |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.