MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external URIs points to 'https://dafemum.ru/aws?utm_term=can+you+retake+the+wand+test+on+pottermore', suggesting a phishing or malicious redirection attempt. The ClamAV detection and ML classifier also indicate malicious intent, likely related to phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/aws?utm_term=can+you+retake+the+wand+test+on+pottermore
- https://cdn-cms.f-static.net/uploads/4446155/normal_60401a9394e5b.pdf
- https://cdn-cms.f-static.net/uploads/4373526/normal_6021ecd103706.pdf
- https://cdn-cms.f-static.net/uploads/4458633/normal_603aab0e97996.pdf
- https://cdn-cms.f-static.net/uploads/4388038/normal_6015b7304fff1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/ec3572bf-e086-4b3c-81fb-0d94641e2c73/angels_on_a_pin.pdf
- https://s3.amazonaws.com/wesezuzuvalirik/zerugudawaxigupax.pdf
- https://1b6fe947-be7e-4494-9a94-f566f178d3d1.filesusr.com/ugd/89064d_5760aeb09de54538ab55c6d7c3be0dd1.pdf?index=true
- https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_3120ca1341e24e1c87e1aa6f8a804409.pdf?index=true
- https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_364a75fb2c7b4517a8b86454e4d76fb4.pdf?index=true
- https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_fd11013510614e1eba51c9570a29fcfb.pdf?index=true
- https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_d5e6c1cbeee948a093ab52b947dee975.pdf?index=true
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_a70c6e23f25848aba71d49b229e7dfd2.pdf?index=true
- https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_54740aae6b324659a133a24bc8f02f15.pdf?index=true
- https://s3.amazonaws.com/nasitevu/mokunepulexit.pdf
- https://s3.amazonaws.com/tokatefozude/how_to_check_battery_health_android_9.pdf
- https://s3.amazonaws.com/divexikav/fawaferubowuwof.pdf
- https://uploads.strikinglycdn.com/files/c47a0a7a-3368-4ef5-88b6-14c5863ca0b4/xusozakojububupape.pdf
- https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_f0e9c7722e204a818cb0f3f9afa7e09d.pdf?index=true
- https://s3.amazonaws.com/geradi/is_white_fang_on_amazon_prime.pdf
- https://992bddda-184d-467f-a815-0165b41a2208.filesusr.com/ugd/69695d_0470805857eb43b2a41353ef5c88cbad.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dfd1.binbb13e6e5dc677264e13301eff0e04d81338110928a407de44b2f6c90e4b4adc0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFD1 | 5284 bytes |
font_01_sfnt_off0000f1b7.bin6018843d6abfaeb429714e4bd7d6685511d722267e0372fd8b0460affa5ee618 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1B7 | 10424 bytes |
font_02_sfnt_off00011549.bin9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11549 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.