MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, many pointing to SEO-optimized PDF download pages, suggesting a link farm or phishing operation. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links are indicative of a malicious lure designed to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffset.ru/123?utm_term=poc+bible+malayalam+audio+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4418370/normal_5fa3b993ea44b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402936/normal_5fafa89f4556d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370540/normal_5f887a3c6222b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403683/normal_5fb59cf77cdb1.pdfIn PDF document text
- https://kebekeloku.weebly.com/uploads/1/3/4/6/134639455/rudisel.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f880c0b93329.pdfIn PDF document text
- https://mowolonob.weebly.com/uploads/1/3/4/8/134874237/lositetof.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385863/normal_5f928410dd0d8.pdfIn PDF document text
- http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
- http://smc.org.inhttp://smc.org.inIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/lejivugeleguwod/damidegogefixafag.pdfIn PDF document text
- https://s3.amazonaws.com/paxivogedewilu/98884555727.pdfIn PDF document text
- https://s3.amazonaws.com/bizamesuwepe/wwe_shield_hd_images_2018.pdfIn PDF document text
- https://s3.amazonaws.com/lanorolowu/o2_sensor_5_wiring_diagram_subaru.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ae2d602-ac8f-4ada-9793-53a49474012b/industrial_revolution_study_guide_word_search.pdfIn PDF document text
- https://s3.amazonaws.com/bajuse/kelogaxifeduv.pdfIn PDF document text
- https://s3.amazonaws.com/dejazuvorira/extraction_of_benzoic_acid_lab_report_introduction.pdfIn PDF document text
- https://s3.amazonaws.com/putelekireza/19936516876.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off0000cd74.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xCD74 | 18708 bytes |
SHA-256: 06a97fc6f46647ec8915ff1067c85818e380fdfdcb7b82f2bcd64c582afd3666 |
|||
font_00_sfnt_off0000bbfa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBBFA | 5148 bytes |
SHA-256: c7e017883610929b8c20dd5a1f24bbd43c7c22ac684a5275e350f4cabdad4e19 |
|||
font_02_sfnt_off0001063d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1063D | 10460 bytes |
SHA-256: c798111557dcd4d4cde59fcf7c380b6ba40760381e506ddb8ce4906d75e9e1db |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.