MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a heuristic firing for a link farm, suggesting it's designed to redirect users to various external resources. One prominent URL, 'https://dafemum.ru/strik?utm_term=download+dbz+budokai+tenkaichi+3+mod+iso', appears to be a lure for downloading game-related files. ClamAV detection as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0' further indicates malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.8155
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=download+dbz+budokai+tenkaichi+3+mod+iso PDF link annotation
- https://cdn-cms.f-static.net/uploads/4378155/normal_604e26da26569.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482190/normal_5ffc57cf83ee5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412591/normal_60662595f2c16.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481278/normal_601595d62493c.pdfIn PDF document text
- https://ronupajowosoza.weebly.com/uploads/1/3/4/8/134871490/fuwedagumabedur_nelisosikasuno_sizekajeta_dewitiribaze.pdfIn PDF document text
- https://gaditefu.weebly.com/uploads/1/3/2/7/132712385/1609172.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502870/normal_5fd27a40b311f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500893/normal_600f3c2c4b675.pdfIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/wuniku/causes_of_counterproductive_work_behavior.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b9ff3de4-c3d4-444a-986c-8540ef3d6711/vupasiwuditin.pdfIn PDF document text
- https://s3.amazonaws.com/dowadotiju/ativador_office_2010_kmspico.pdfIn PDF document text
- https://s3.amazonaws.com/satuja/33210588463.pdfIn PDF document text
- https://s3.amazonaws.com/somamere/fosinefekovosajax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/adc7304a-3086-4a11-9d5a-32c744ccd389/38994934707.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/34a8cb77-c992-4369-9eaa-034a1f53b1d5/is_gdp_a_good_measure_of_economic_well_being_quizlet.pdfIn PDF document text
- https://s3.amazonaws.com/nezanurugega/durable_financial_power_of_attorney_form_az.pdfIn PDF document text
- https://s3.amazonaws.com/petuzutemixuvod/jonutunizelabikisurad.pdfIn PDF document text
- https://s3.amazonaws.com/gimufesajo/taco_bell_chicken_taco_salad_no_shell_calories.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d1650e50-977a-42ed-be6d-39698d556154/walmart_pharmacy_near_me_open_24_hours.pdfIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off00013cb2.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x13CB2 | 8436 bytes |
SHA-256: 45316c68429d95c73f023e7ef84e63644e0a3fb5d0ae5d1522e15e7caf899f52 |
|||
font_00_sfnt_off00010dbf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DBF | 8364 bytes |
SHA-256: 023c2cc1c6ed3ee9f4c417a9cd976be5688e5173ed5e099861527c2dfe7a7294 |
|||
font_01_sfnt_off000129bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x129BC | 5592 bytes |
SHA-256: 4eeab4f7b91a54c5de50a97f86897b135eed62b54452797f3248b93673276274 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.