MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded URLs, with a prominent one leading to 'lozipotod.ru'. This URL is associated with a heuristic indicating a link farm on disposable hosting, suggesting a phishing or malicious redirection attempt. The document body, though heavily obfuscated, contains text related to fitness routines, likely a lure to disguise the malicious intent. The ML classifier and ClamAV detection strongly indicate maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=how+many+days+a+week+should+you+do+p90x PDF link annotation
- http://mazikopipovix.mywebcommunity.org/bossypants_audiobook.pdfIn PDF document text
- http://dotekebenutedex.scienceontheweb.net/international_finance_management_mcq.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453342/normal_605a6b6159ff2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4463010/normal_603c7d756fa48.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4486550/normal_6038b8f133f61.pdfIn PDF document text
- http://pasikufopubiwo.mypressonline.com/cfa_level_1_material.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481062/normal_605668944aab7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a53fcf70-04dc-468c-b16b-91f20e80c8bc/88937646561.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a735392-1a8e-4da5-94ce-9a25f62b1e78/68962008633.pdfIn PDF document text
- https://bed2d873-735b-46bb-a8a3-264d0455df4e.filesusr.com/ugd/03ede2_c967946640ee423f845a48f7dec98e78.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/muvojugejoxip/vuxepove.pdfIn PDF document text
- https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_12a10c7970cd4c3896a4290fa5e0581f.pdf?index=trueIn PDF document text
- https://6a9ecc2b-05c3-4056-8705-773ae6be8cdd.filesusr.com/ugd/7a359d_c201aec3f0fe44c2828a058f7d9566ed.pdf?index=trueIn PDF document text
- https://7fd4abad-31f8-4c52-ae8e-93d0cc7f2af2.filesusr.com/ugd/910e70_2ae4316b07654981bb64b2f15c65fa59.pdf?index=trueIn PDF document text
- https://67389751-14cc-4ed3-b660-7ef7239e4cc3.filesusr.com/ugd/bb5584_f57b17c0cf954abc8d210c6f2d678b53.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e92c35e6-5f30-4eee-8946-32a68c903a2e/what_is_a_peoples_choice_award.pdfIn PDF document text
- https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_7ce5ded3c4f8470c974a2113d94b4d30.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2825fe98-1a8f-4266-a619-d9c52578dc0e/girosutajepan.pdfIn PDF document text
- https://fae5df41-d68b-4d62-9961-cd33801cec7e.filesusr.com/ugd/f52c73_ec346bd2419645a3950c8925ded9a004.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gewisetug/bang_bang_movie_song_ming._com.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/06d32a25-97b0-408b-ad21-83c4b1a61dcf/why_is_my_rv_furnace_so_loud.pdfIn PDF document text
- https://459fb65c-52af-4c88-885a-43a44fbeaf25.filesusr.com/ugd/6a7407_2b735a7c7a2d44c59fd651a7ad479fc0.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sixolose/how_to_transfer_contacts_from_motorola_to_lg_phone.pdfIn PDF document text
- https://s3.amazonaws.com/bomifabipi/game_of_thrones_wiki_season_2_episode_5.pdfIn PDF document text
- http://sarutufasiko.atwebpages.com/35110050443.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010db0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DB0 | 5688 bytes |
SHA-256: 8e861bdfa25b813093444f4bb27ac12d88e941ce341f3309b4711e9d006dbf16 |
|||
font_01_sfnt_off000120fe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120FE | 11228 bytes |
SHA-256: 409d1efa0bd7ebad61edb97d5c234fb7a2f1960ed2bc49b1fb04995abe3ee25d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.