MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating maliciousness. It contains a large number of external links, suggesting a link farm or SEO poisoning attempt. The document body, though truncated, contains a title related to contacting editors, which combined with the external links, points towards a phishing or malicious redirection scheme. No scripts were extracted, but the presence of numerous external URLs indicates a likely attempt to redirect the user to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9947
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=how+to+contact+wsj+editors
- https://xipurewaxo.weebly.com/uploads/1/3/4/7/134759043/wudajow.pdf
- https://static.s123-cdn-static.com/uploads/4393370/normal_5ff3fbd2cd842.pdf
- https://falototadapi.weebly.com/uploads/1/3/3/9/133989324/zuzixuz_fugopiri_xofozaz_kopegidarar.pdf
- https://static.s123-cdn-static.com/uploads/4408481/normal_5ffdfa30adafe.pdf
- http://lapitubemexidi.mywebcommunity.org/overeating_anonymous_books.pdf
- https://cdn-cms.f-static.net/uploads/4446286/normal_5fd110e412696.pdf
- https://cdn-cms.f-static.net/uploads/4486965/normal_600dddb9837d3.pdf
- http://dexizixefufene.iblogger.org/bigikezujovipuxofevi.pdf
- http://lubevos.scienceontheweb.net/amitabha_sutra_english.pdf
- https://xanuvomapimiv.weebly.com/uploads/1/3/4/3/134342034/7964806.pdf
- https://static.s123-cdn-static.com/uploads/4413363/normal_5fdf66717112a.pdf
- http://vovevowumusiki.iblogger.org/jo_bich_bajariya_dj_song.pdf
- https://luzepazokiguj.weebly.com/uploads/1/3/4/3/134396814/megamalukewowumujix.pdf
- https://xukovijo.weebly.com/uploads/1/3/4/6/134611059/56a5e1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://gumelojapa.epizy.com/10630733067.pdf
- https://uploads.strikinglycdn.com/files/1623b6f5-f03a-4f4e-b63d-159b074e5ccc/in_the_woods_tana_french_spoilers.pdf
- http://gesutebixip.epizy.com/vufidefizumovetuvoxo.pdf
- https://uploads.strikinglycdn.com/files/f3e73dc2-7456-44e6-afc5-3f65bec12080/why_phone_charger_not_working.pdf
- https://uploads.strikinglycdn.com/files/88213efb-fc5a-48fd-95a8-a954f2c3197a/terapubotibabobipikawu.pdf
- https://uploads.strikinglycdn.com/files/e633cebe-3103-4f81-8989-da4c611b1516/7081259513.pdf
- https://uploads.strikinglycdn.com/files/1a2190e0-9851-4b14-beaf-ee80e39e9a13/wesonupipofolage.pdf
- http://puvapulugo.onlinewebshop.net/arguing_with_idiots.pdf
- http://momerulazem.rf.gd/bullet_basya_movie_song.pdf
- https://uploads.strikinglycdn.com/files/8baf7849-289d-4e6e-95c4-b70297011d62/phoenix_sorcerer_revised.pdf
- https://uploads.strikinglycdn.com/files/d42ea19c-3db8-4c4e-8743-b9be8fc654ff/weight_watchers_digital_scale_review.pdf
- http://vekabun.myartsonline.com/derirobomedadera.pdf
- https://uploads.strikinglycdn.com/files/a2685413-78b5-4d3e-a719-de60a0106e03/g43t-dm1_v_a00_motherboard_bios.pdf
- https://uploads.strikinglycdn.com/files/deb66db9-1548-4a83-983f-1d3abc8aa05f/how_to_refuse_mail_and_return_to_sender.pdf
- https://uploads.strikinglycdn.com/files/5ccd8d5e-6524-4b75-aca2-a3dfd06dbedc/how_to_reset_voicemail_on_vtech_phone.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001012c.binaff967324827a03ba7dfea70b288e50dce5bb670965f138a569c85d9fa39e7bb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1012C | 4816 bytes |
font_01_sfnt_off0001119b.bin880a8f2df2b64815ae06ec40059e330ab2e205d713bc383613a53275401264e6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1119B | 11752 bytes |
font_02_sfnt_off00013944.bin1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13944 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.