MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded URLs and is flagged by multiple heuristics, including ML and ClamAV, as malicious and phishing-related. The document body, though heavily obfuscated, contains references to 'mkx app cheats' and application names, suggesting a lure to trick users into visiting malicious sites for fake cheats or guides. The presence of numerous external URIs and link farm indicators further supports a phishing or malware distribution intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/wix?keyword=mkx+app+cheats PDF link annotation
- http://astropsychology.site/65270500173civ08.pdfIn PDF document text
- http://instahelpforbusiness.com/nejerigazuwugubikevujarabias2.pdfIn PDF document text
- https://cdn.sqhk.co/xumesapaxoku/c653biF/77845177829.pdfIn PDF document text
- http://lavkavkusa.store/speak_study_guide_answer_key0ihhm.pdfIn PDF document text
- http://milesnires.xyz/new_zealand_standard_curriculum_vitae_templatesgiit.pdfIn PDF document text
- http://micrometerdigital.xyz/27558123515yjrk6.pdfIn PDF document text
- http://artistichomesolutions.com/what_are_the_3_levels_of_strategy3izn4.pdfIn PDF document text
- http://kinoxca.xyz/craftsman_yt_3000_blade_part_number9y8ih.pdfIn PDF document text
- https://cdn.sqhk.co/feripamapuv/hhifsjZ/grand_alliance_death_blade_of_the_blood_queen.pdfIn PDF document text
- https://cdn.sqhk.co/xojelumegasi/5AppgdZ/mtg_war_of_the_spark_draft_strategy.pdfIn PDF document text
- https://cdn.sqhk.co/badaxiloru/XvgjWlh/20521569115.pdfIn PDF document text
- https://cdn.sqhk.co/gasariba/ch1ifjh/super_jumbo_world_history_timeline_poster.pdfIn PDF document text
- http://appletopshop.ru/8791312924vnkq0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_92824abead13458593bba0a66887861c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7fbdad32-936d-47af-a17e-4d479b045830/76981660431.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/06eb42aa-eea5-4290-a88a-0311a3d60621/algebra_with_pizzazz_answers_key_what_were_the_headlines.pdfIn PDF document text
- https://13a7c488-548c-4b48-b567-d2b0b9a3e1de.filesusr.com/ugd/85d67f_8ee88d6cb17741418fbaacfc9fbe03ad.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/87917f51-69cd-4e42-9938-3a377b812f98/how_do_we_measure_organizational_culture.pdfIn PDF document text
- https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_d08a06ad671a40eabaad95d628c831d0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3ef1345c-8c2d-419a-98a5-a806c6679e16/fozobuka.pdfIn PDF document text
- https://7e079b21-6cfc-4bbc-a8af-001f4930a7f2.filesusr.com/ugd/f66805_75f6eef0d649476596523e03aed33656.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1846249b-d125-4517-a3f2-e8980d227f15/83103123185.pdfIn PDF document text
- https://e905a76e-7bc1-418c-be29-e8eda1603e86.filesusr.com/ugd/3fb32a_0831dcb9fef94e878f641c95971c3e17.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/99062d56-7af3-4003-ba9f-3087bb560fd7/mijagola.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec65.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC65 | 5028 bytes |
SHA-256: ccd7ffd10a1c308ceaffa7df8fcf3aebdc5ec693d950db6be71f75d1066ca4fa |
|||
font_01_sfnt_off0000fd94.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD94 | 10988 bytes |
SHA-256: c9be93a99e6ba2ec3b30705c70952f024fc9aeceee89f0fd375a317fce3e727b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.