MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs, with a primary suspicious URL pointing to 'seumenha.ru'. The PDF structure and embedded content suggest it functions as a lure, potentially for phishing or to download further malicious content, aligning with spearphishing attachment tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/wix?keyword=go+math+workbook+grade+5+pdf PDF link annotation
- http://subejewumo.scienceontheweb.net/calendario_laboral_2020_catalunya_para_imprimir.pdfIn PDF document text
- http://nipawifaxupus.mygamesonline.org/romodew.pdfIn PDF document text
- https://cdn.sqhk.co/tawibonikigo/gcy6gg7/78779858552.pdfIn PDF document text
- https://cdn.sqhk.co/wifopuzuxiba/ihjz8hc/fall_season_starts_2020.pdfIn PDF document text
- https://cdn.sqhk.co/bisulalu/e5hbhgC/getofalafozinowisilu.pdfIn PDF document text
- https://cdn.sqhk.co/wanevakaxuma/CthcQKH/fesadaloge.pdfIn PDF document text
- https://cdn.sqhk.co/wavudasawete/Ehihhy1/strategic_management_examples_ppt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/93c804c5-0a7a-43df-95d6-11a40702c585/88511242418.pdfIn PDF document text
- https://s3.amazonaws.com/fedufiporara/banesco_movil_apk_descargar_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d419cbf2-d2c1-4a1b-82e5-c2899e99ce60/what_does_the_song_take_me_home_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e09d5e40-cee6-4c4d-881b-ff1b62cd542f/75747647487.pdfIn PDF document text
- https://b32521b7-32ca-447e-9967-d27d0dce683d.filesusr.com/ugd/800b88_30bd6bf93f39468e8c8efdc8bc80fd36.pdf?index=trueIn PDF document text
- https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_34aec0300026418584aab5ece714e522.pdf?index=trueIn PDF document text
- http://suvusere.epizy.com/relugonuzafigepobimo.pdfIn PDF document text
- http://xodeboraduzex.epizy.com/making_customs_declarations.pdfIn PDF document text
- http://jemileti.atwebpages.com/jesuxadifexixaxurez.pdfIn PDF document text
- http://gapisamiwabu.epizy.com/formica_sheets_for_kitchen_walls.pdfIn PDF document text
- https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_6520dfff6ef84449ae095b3b2f63efc7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pirosisob/65158405278.pdfIn PDF document text
- https://02664c88-84e5-42fa-aae3-682d3a0d4328.filesusr.com/ugd/39d081_8fb6ea39e036435384b330552ca2cea9.pdf?index=trueIn PDF document text
- http://bolesumedinix.rf.gd/personal_factors_affecting_consumer_behavior.pdfIn PDF document text
- https://s3.amazonaws.com/zebarufuridorur/instagram_update_apkpure.pdfIn PDF document text
- https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_f95b2ef9a4e243dd98005a27f54d902f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ea5904c9-f7e4-40a8-b041-7a207e92ca33/fobaxojawilegiw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6b4facc0-77ff-4665-8b90-32233263ae07/the_mortal_instruments_city_of_bones_book.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000df44.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDF44 | 5696 bytes |
SHA-256: 71afa2dbe1e1d9be56b38ae49bc138c62575f4a368c803501f108a3e2ec2695d |
|||
font_01_sfnt_off0000f298.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF298 | 10940 bytes |
SHA-256: bc65efc095b55cfe05c573ba2f151501d3373cc54d3cf4a06dec0b5f5cc67ee2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.