MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'crophysi.ru'. The document body, though heavily obfuscated, contains text related to 'Has no game no life season 2', suggesting a lure to entice clicks. The presence of numerous links to disposable hosting and the ML classifier's high confidence further support a malicious intent, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/strik?utm_term=has+no+game+no+life+season+2+been+confirmed In PDF document text
- http://fevalugumaj.22web.org/singer_simple_3337_bobbin_tension.pdfIn PDF document text
- http://tivaser.iblogger.org/zotosevusofolin.pdfIn PDF document text
- http://testersairf.xyz/wuvubikejevilokemupevxhw6.pdfIn PDF document text
- http://50offshop.pro/red_ball_4_stage_54zf21t.pdfIn PDF document text
- http://study-english-05.site/gudaralejovevetubolu57o04.pdfIn PDF document text
- http://ita-fitness.fun/impact_of_globalization_on_african_cultureftjl4.pdfIn PDF document text
- http://autobaff.xyz/kikirodara6ftat.pdfIn PDF document text
- http://rekusigixebisuk.22web.org/curso_de_acordeon_de_botones_gratis.pdfIn PDF document text
- http://bossyonlinex.com/govudotavawijajilojazidujybpe.pdfIn PDF document text
- http://thefortykuti.com/infection_prevention_and_control_in_hospitals_pptqgwh2.pdfIn PDF document text
- http://chambreapp.xyz/7079441667479w33.pdfIn PDF document text
- http://arthromedro.xyz/what_are_the_hours_for_walmart_todayrt9kr.pdfIn PDF document text
- http://playmarket-online.com/migipexofizameferibewlg5wb.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sorogamat/media_player_notification_android_example.pdfIn PDF document text
- https://s3.amazonaws.com/kuboki/brother_birthday_tamil_song_free.pdfIn PDF document text
- https://c6111751-42b6-464f-a8b1-832d492ff999.filesusr.com/ugd/3d0627_1d3478476a7548ee8d5518bd7026e3af.pdf?index=trueIn PDF document text
- https://8d537faf-e869-4ed9-a29f-988560fab1dc.filesusr.com/ugd/0cce51_d3e289b79cce47fc8c8447b3ea6e841a.pdf?index=trueIn PDF document text
- https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_40b8cbe4c1754970a3b27e36602a0c11.pdf?index=trueIn PDF document text
- https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_64ef9d3aec2d413e826af0b1780bc5a7.pdf?index=trueIn PDF document text
- https://f5f74d4f-f804-4d9b-9bfa-9964b2756261.filesusr.com/ugd/e389b3_6c1d76ecb332405c8019f745ed8576f6.pdf?index=trueIn PDF document text
- http://medomapex.epizy.com/91083701386.pdfIn PDF document text
- https://s3.amazonaws.com/bisapovepizaj/tolerable_error_and_performance_materiality.pdfIn PDF document text
- https://s3.amazonaws.com/xukonakefules/fapekutaxu.pdfIn PDF document text
- http://duliwijedij.rf.gd/prefix_suffix_word_list.pdfIn PDF document text
- https://da18e6a8-d720-42de-a88c-3f13daad7efb.filesusr.com/ugd/08fe48_749f38bb635a4b89a0aebf1f294afbe5.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010535.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10535 | 5572 bytes |
SHA-256: 6e3842dca8a09d7a1599c3a30e25f6a2f2e1b9e157393c2f8a1ffd9ec453e0c7 |
|||
font_01_sfnt_off00011811.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11811 | 11044 bytes |
SHA-256: bb3e37a1212f3f3ca60c7f9717fabea8c34b52b1e47ac232c40392c7c20ee1b0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.