MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with at least one identified as a malicious redirector. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a deliberate attempt to create a large number of links on disposable hosting, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection further support the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=emergency+medicine+doctor+requirements In PDF document text
- http://woziwowariv.sportsontheweb.net/dilavovewa.pdfIn PDF document text
- http://discount50.pro/63787159569x7n86.pdfIn PDF document text
- http://help-business-media.com/gigabyte_b450_aorus_elite_user_manualyrsne.pdfIn PDF document text
- http://julivojurukumu.sportsontheweb.net/how_do_you_draw_infection_out_of_a_finger.pdfIn PDF document text
- http://evilcheats.fun/wmf_5.0_download_windows_2012_r2xw7ux.pdfIn PDF document text
- http://botefin.medianewsonline.com/project_risk_management_plan_sample.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0c2f2228-633a-4989-9618-78f54286a49d/meniteterokujo.pdfIn PDF document text
- https://s3.amazonaws.com/gimisorixosu/bailaras_full_movie_song.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b1914ea7-1042-486f-a640-db5a607d5a94/niginulixolel.pdfIn PDF document text
- http://tipiwozametorol.epizy.com/que_es_un_estilo_de_vida_saludable_brainly.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ffae0597-2f50-44af-9bfc-88cea82db12e/punctuation_exercises_with_answers_for_grade_5.pdfIn PDF document text
- https://s3.amazonaws.com/fejififimaketo/tuvofikapafatunerexumud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a309d96a-876b-4434-b03a-0ea3316fa70d/65408590012.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a221eeef-b1ff-48cc-b044-0a462c0a3fd8/samsung_galaxy_s9_price_in_pakistan_today.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b15b3bd-fb55-4700-a386-b96816ce56a5/fijasupesemumodefeledu.pdfIn PDF document text
- https://s3.amazonaws.com/bifadiwuwileji/sawujulufoxagexupofixa.pdfIn PDF document text
- http://zinipuzotekum.rf.gd/astro_a20_wireless_headset_ps4_slim_setup.pdfIn PDF document text
- https://s3.amazonaws.com/gafedupeba/zujedizepasekuwagi.pdfIn PDF document text
- https://s3.amazonaws.com/gapuruxumeg/alfredo_soares_bora_vender.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93b05f81-c51e-4dbd-9443-105c253c4617/samsung_138_cm_55__smart_uhd_curved_tv_review.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
- http://www.geocities.com/dnhhngIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001d1cb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1D1CB | 7036 bytes |
SHA-256: d65e7b7891f191f380d379a63cd3b68ad64965d52e5a253801d273052d9bc5db |
|||
font_01_sfnt_off0001e992.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E992 | 5204 bytes |
SHA-256: 9fc29ef89e4def86ae57d7c4dd6b3fb0f52d1e78b4e66967e4314cdadd5cfe59 |
|||
font_02_sfnt_off0001fb2d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1FB2D | 11492 bytes |
SHA-256: a5f72ce5dac349c8cf50185b7ac2d60ea4fd769574f842baf60b5b65d2604330 |
|||
font_03_sfnt_off000217de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x217DE | 19180 bytes |
SHA-256: fa071d12b3079a7a10ec9a5dda31850bbb7cf311eda5daa11a02c0cdde1c237a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.