MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan and an ML classifier indicating maliciousness. It contains a large number of external links, many pointing to PDF files hosted on Weebly, suggesting a link farm or redirection mechanism. The primary external URL, https://gimoguvi.ru/award?keyword=area+of+triangular+prism+worksheet+pdf, indicates a lure to disguise the malicious intent. No scripts were extracted, but the PDF structure and numerous external links strongly suggest it's designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9964
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/award?keyword=area+of+triangular+prism+worksheet+pdf PDF link annotation
- https://malegudupo.weebly.com/uploads/1/3/0/8/130813961/peretewi.pdfIn PDF document text
- https://mojivuza.weebly.com/uploads/1/3/0/7/130775228/remij.pdfIn PDF document text
- https://wesaxewotivaf.weebly.com/uploads/1/3/4/5/134578523/subekavokidobew.pdfIn PDF document text
- https://faripolugariwel.weebly.com/uploads/1/3/1/4/131453512/xotepitu_romojopexuvuxer_bewaxiwovos_ruxozujow.pdfIn PDF document text
- https://nunoperiv.weebly.com/uploads/1/3/1/8/131856708/fasebaxoja.pdfIn PDF document text
- https://suxapenogabako.weebly.com/uploads/1/3/4/6/134602080/dimugagipe-buxufikimujejis-milemoj.pdfIn PDF document text
- https://sikiroradimer.weebly.com/uploads/1/3/4/6/134619363/66096b1238ed.pdfIn PDF document text
- https://jazedase.weebly.com/uploads/1/3/3/9/133997310/kawig.pdfIn PDF document text
- http://fasekafalig.scienceontheweb.net/ethanoic_acid.pdfIn PDF document text
- https://wifusudufasebo.weebly.com/uploads/1/3/5/9/135992472/2730153.pdfIn PDF document text
- https://jasugupaxawuz.weebly.com/uploads/1/3/0/7/130740610/28159.pdfIn PDF document text
- http://jaxifas.getenjoyment.net/41406027420.pdfIn PDF document text
- https://gulatavinijigu.weebly.com/uploads/1/3/4/5/134507109/bosununuf_mozevukukam.pdfIn PDF document text
- http://tezijexipilimo.getenjoyment.net/jarosex.pdfIn PDF document text
- https://sunudufexune.weebly.com/uploads/1/3/0/8/130874439/mumadujebevoxutex.pdfIn PDF document text
- https://bilemupu.weebly.com/uploads/1/3/4/6/134654663/xesipazaselu-lunivepiloras.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/wudibirewuduto/mufaloxir.pdfIn PDF document text
- https://s3.amazonaws.com/dujepav/adobe_illustrator_android_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0cb9e30a-2f08-4482-b658-371a50411d6a/41626766684.pdfIn PDF document text
- https://s3.amazonaws.com/wekibik/how_to_read_button_accordion_sheet_music.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ad3ca28-6f80-4d77-9295-1b6d120d2e5d/what_is_the_traditional_music_of_south_africa.pdfIn PDF document text
- https://s3.amazonaws.com/runuzitexokol/six_pack_abs_workout_plan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b011a4dc-d0bb-45da-851f-c27072353a83/luwora.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30fb8609-1f0c-4f9f-9770-fd59c043cfdf/easy_hindi_songs_to_play_on_guitar_tabs.pdfIn PDF document text
- https://s3.amazonaws.com/liguwubore/everfi_module_6_higher_education_answers.pdfIn PDF document text
- http://ropupifalapoges.atwebpages.com/biriwimuzugesigozapozujux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da5031b9-a9c7-4b1d-a2d3-d32ef450c14e/sobuwajofukepegese.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f72e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF72E | 5600 bytes |
SHA-256: 6594833b4d30ce7acece367d6aa73ad69065af9944f67a50e4552d566f781acb |
|||
font_01_sfnt_off00010a25.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A25 | 11276 bytes |
SHA-256: 40b0800c99560230104f86c16dd8ff4bbc1605ef5c3816e7a34ebbeb31dcd98b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.