MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple external links, with one specifically pointing to a game download, suggesting a lure for malware. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may be part of a multi-stage attack involving password-protected archives. ClamAV detection and ML classification strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=download+game+ps1+yu+gi+oh+forbidden+memories+iso PDF link annotation
- https://cdn-cms.f-static.net/uploads/4469640/normal_6044401f7b0ec.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420449/normal_6059bc9dc3408.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393362/normal_6028777a469b8.pdfIn PDF document text
- https://juvidefe.weebly.com/uploads/1/3/4/3/134319267/91524.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446259/normal_5fc80dc364d94.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4369165/normal_60b002196be61.pdfIn PDF document text
- https://simefaburiso.weebly.com/uploads/1/3/0/8/130814859/c46eaa82acff41.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419630/normal_605cb0cdcf14e.pdfIn PDF document text
- https://sejiganabukuja.weebly.com/uploads/1/3/4/5/134585043/zixibobazet.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4377407/normal_5fca7de4e00b7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479433/normal_5ffad0e3d99e8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489259/normal_6035551c20024.pdfIn PDF document text
- https://gorogonib.weebly.com/uploads/1/3/0/7/130775466/541827.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4386084/normal_5fcc0e27568b9.pdfIn PDF document text
- https://degezumibupupek.weebly.com/uploads/1/3/4/8/134862322/92dd93668e4322.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491432/normal_600c79cbb11b9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/25102190-992d-491d-991a-074e2eb0ea2b/ingenuity_cradling_bouncer_weight_limit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b11ad73-9948-4325-8bac-96c9b4b1cf98/wisukona.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/08ce6696-fab2-4895-9b9e-eae28c1dca51/what_is_ni_hao_in_chinese.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46c02a2b-f6cc-438c-a1c7-fdfafaaf497e/initiation_sylvia_plath_audio.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e5af.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE5AF | 5840 bytes |
SHA-256: 502ee53c6c6bda8895a0efb0407b27c7bc023e75dc40972a5e6e726341f6b893 |
|||
font_01_sfnt_off0000f97f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF97F | 3648 bytes |
SHA-256: cf46c79abc3f91fca6a0b780196a53bb11a211061a99e948d05ef5780aeaeea8 |
|||
font_02_sfnt_off000106cd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106CD | 12588 bytes |
SHA-256: 4ee2fa12e737dde0ca3cbce7f67639cf84eb242a4ca02991fd15ef54abdee5eb |
|||
font_03_sfnt_off00012e8b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12E8B | 16036 bytes |
SHA-256: bc1c1644e30597ae0beaac312b9749a82b64e26c109397326cdc67fdbaf2fe17 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.