MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are obfuscated or use link farms, indicating a phishing or malware distribution attempt. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URIs point towards a malicious document, likely a spearphishing attachment designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/wix?keyword=ray+of+exhaustion+starfinder
- https://cdn.sqhk.co/tosilura/rjaAP5Y/9133544238.pdf
- http://velesvoyage.ru/how_to_write_good_essay_conclusion7xic8.pdf
- https://nikigefewava.weebly.com/uploads/1/3/0/7/130775032/5e1040ac46.pdf
- https://cdn-cms.f-static.net/uploads/4460251/normal_60388c0d61154.pdf
- http://arendaavto.taxi/hammock_knotsorf86.pdf
- https://cdn.sqhk.co/dasofuduveje/l7ggd59/18020494699.pdf
- https://cdn.sqhk.co/jurufovowufu/lM4U5gf/yu_gi_oh_duel_links_decks_best.pdf
- https://fosevikotik.weebly.com/uploads/1/3/1/6/131637163/ponazemotoxuzizusi.pdf
- https://cdn.sqhk.co/fawabanof/gIbhfcL/rebuxofewotavosazurajixab.pdf
- https://cdn.sqhk.co/pujazojiwixi/hh4Krgh/wyvern_dark_souls_2.pdf
- https://jedexapotup.weebly.com/uploads/1/3/4/4/134472831/7760564.pdf
- https://static.s123-cdn-static.com/uploads/4367624/normal_6003618e442b5.pdf
- https://cdn.sqhk.co/kufalavoxig/whajduF/steam_cleaner_black_friday_sale.pdf
- https://cdn.sqhk.co/tixuniwe/ylib9jd/pressure_washer_pump_saver_amazon.pdf
- https://cdn.sqhk.co/wazikunal/jiahfDP/82280611486.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jozetej/jetson_nano_datasheet.pdf
- https://s3.amazonaws.com/nuselufuzo/33608740739.pdf
- https://s3.amazonaws.com/mozedijiz/nudetijosisum.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010368.bin0498f1cc4c14d9bd26924d84f830fe0d096d70826b19c6a864e4d9cd4d1571f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10368 | 5140 bytes |
font_01_sfnt_off000114f2.binbc374ec5677fbb6636c82e0ec55acac50e2dd1f9bcc4df44b8d822f453f513ff |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114F2 | 9900 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.