MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one prominent URL pointing to a site offering 'unlimited gems' for Clash Royale, a common lure for downloading malware. The PDF structure and embedded content suggest it's designed to exploit user interest in game cheats to deliver a malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=unlimited+gems+clash+royale+apk PDF link annotation
- http://vodoroding.info/anti_school_uniforms_argumentss70cj.pdfIn PDF document text
- http://furniture21.online/dance_music_videos_for_toddlers5hbpd.pdfIn PDF document text
- http://sitebomobegux.sportsontheweb.net/xewasunoxa.pdfIn PDF document text
- http://3-bureaureport.info/lekasegevifemefusijaxc0i5q.pdfIn PDF document text
- http://girlita.space/rosalina_and_luma_guide_smash_ultimateupfw4.pdfIn PDF document text
- http://tafugegajotu.mygamesonline.org/46992766012.pdfIn PDF document text
- http://tujemet.scienceontheweb.net/morasijimon.pdfIn PDF document text
- http://sagedix.medianewsonline.com/darrieus_vertical_axis_wind_turbine.pdfIn PDF document text
- http://kafalukuwemi.mygamesonline.org/technical_writing_course_curriculum.pdfIn PDF document text
- http://bulakirip.getenjoyment.net/dark_tower_series_in_reading_order.pdfIn PDF document text
- http://sawemawe.mywebcommunity.org/infringement_of_patent_and_legal_remedies.pdfIn PDF document text
- http://wivuperafuzo.mypressonline.com/analytical_reasoning_questions_with_solutions_for_gat_general.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a16ba774-bdf8-4d71-9595-16bf32abbbb2/75584477879.pdfIn PDF document text
- https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_d33efa3a6afd4e3dac43be148ee471b0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/207ac94e-17a5-4afa-af51-0e6e9be15b67/33000706858.pdfIn PDF document text
- https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_debaa28d929244a39c7c94ba2fc9c9d6.pdf?index=trueIn PDF document text
- https://fe426b01-1dd0-498a-b08e-7ec37e320b94.filesusr.com/ugd/6b45f0_5f4dc0daa9fd4a248c9c04aad7050272.pdf?index=trueIn PDF document text
- https://5db246a0-94da-4013-9f64-c970003367b9.filesusr.com/ugd/ca5179_e8e9bc0a49524afb99eb58eb14b4ee50.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/22153120-8cfd-411c-bcbe-bf73980fd28d/segodufiji.pdfIn PDF document text
- http://tofalit.myartsonline.com/jumisupojeniru.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93384fbd-197e-49a6-b3f5-3577bf214de9/sketchup_free_vs_shop_vs_pro.pdfIn PDF document text
- https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_8ba0d0eea6f34ad99d70b085ef670e01.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/61e5df53-fa76-4182-ad3e-eb0827a6446b/kinodofivejexete.pdfIn PDF document text
- https://c33c3ce4-fa2f-4f19-9477-7a801b41b29e.filesusr.com/ugd/ebbcbd_6c72a58dcc1f419f9646f4868de8151b.pdf?index=trueIn PDF document text
- https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_14e0e213f647465c97097b5142eb0458.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001011c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1011C | 5644 bytes |
SHA-256: 71e78ec82c65bb97ea65ddbd9b049e5daeb24938901a02e2f046e0e8d4f4ec28 |
|||
font_01_sfnt_off0001142f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1142F | 11336 bytes |
SHA-256: 9e1ac158d67fd42ac265d96d37f65a587593cba90c553a20e705613e407593df |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.