MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.6091
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://tevav.co.za/XSRYdR1H?utm_term=name+caller+ringtone+song PDF link annotation
- https://rpdev.org/ckfinder/userfiles/files/zupurunugizegekowofip.pdfIn PDF document text
- https://aymexco.eu/ckfinder/userfiles/files/zedoruzobupelubopi.pdfIn PDF document text
- http://liavanhaeringen.nl/userfiles/files/ranegatasiwojovovi.pdfIn PDF document text
- http://sromedical.com/file_media/file_image/file/12040456024.pdfIn PDF document text
- http://sgrappresentanze.eu/userfiles/files/14392823323.pdfIn PDF document text
- http://ordineveterinarivenezia.eu/userfiles/files/6977599524.pdfIn PDF document text
- https://febrerasesores.com/uploads/kcfinder/upload/files/gapofaseduxanu.pdfIn PDF document text
- http://herbwaterthailand.com/userfiles/files/26113556922.pdfIn PDF document text
- http://nishikizushi.com/js/kcfinder/upload/files/zumevijo.pdfIn PDF document text
- http://iwebcambodia.com/admin/kcfinder/upload/files/xedoda.pdfIn PDF document text
- https://univrab.ac.id/assets/plugin/kcfinder/upload/files/19197853760.pdfIn PDF document text
- https://www.andimoda.com/wp-content/plugins/super-forms/uploads/php/files/20a3de409f1240c193bdf24e2efd31e6/55517162300.pdfIn PDF document text
- https://njsolarpower.com/wp-content/plugins/super-forms/uploads/php/files/7c084d85c336fa85d1c214088369f3f7/fasozisolajifuk.pdfIn PDF document text
- http://www.emporiocaritaspisa.it/wordpress/wp-content/plugins/formcraft/file-upload/server/content/files/1620d81da85950---86735480453.pdfIn PDF document text
- http://magnumprint.ru/upload/files/44097396156.pdfIn PDF document text
- https://netiko.fr/img/Data/file/29888967879.pdfIn PDF document text
- http://www.impactit.in/ckfinder/userfiles/files/daxot.pdfIn PDF document text
- http://oiseau-bleu-morzine.com/userfiles/file/47230880032.pdfIn PDF document text
- https://editions-tlp.fr/ckfinder/userfiles/files/nusuz.pdfIn PDF document text
- https://www.madenisg.org.tr/kcfinder/upload/files/38360027605.pdfIn PDF document text
- http://fotosvatba.net/userfiles/file/vetiwekofuvapot.pdfIn PDF document text
- http://cancunday.com/travela/img/files/riguxuxi.pdfIn PDF document text
- https://cgb-echafaudage.fr/upload/files/zurudelo.pdfIn PDF document text
- http://polkovnik.su/upload/file/xefuxetirimodavu.pdfIn PDF document text
- http://pyhunlian.com/uploadfile/file/kutovudigapavulos.pdfIn PDF document text
- http://htk2.altrodesign.eu/ckfinder/userfiles/files/lojusejidalobasixutoju.pdfIn PDF document text
- http://dongamold.com/fckeditor/upload_files/file/sotuvetekava.pdfIn PDF document text
- http://milkexim.ru/imgeditor/file/raborogoxozilifenidupise.pdfIn PDF document text
- http://iharoskezmuvesek.hu/ckeditor/kcfinder/upload/files/60570395588.pdfIn PDF document text
- http://kp-technik.cz/ckfinder/userfiles/files/jenowovupinagaseso.pdfIn PDF document text
- http://rana-international.com/userfiles/files/fujed.pdfIn PDF document text
- https://esterkins.de/ckfinder/userfiles/files/pegexapawitukiko.pdfIn PDF document text
- http://imcborivali.org/userfiles/file/35536919179.pdfIn PDF document text
- https://campfun.myhost888.com/upload/ckeditor/files/49128657239.pdfIn PDF document text
- http://polethique.ch/uploads/files/loferunuwasumabukefesam.pdfIn PDF document text
- http://xn--365-pn7mwb654m2qn.com/ckupload/files/gatituv.pdfIn PDF document text
- https://actsonics.com/uploads/files/202202280148459798.pdfIn PDF document text
- https://arch.ua/ckfinder/userfiles/files/3328514485.pdfIn PDF document text
- https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/e165b990982acb101a3bd9fdee9f3e92/moxawadin.pdfIn PDF document text
- http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/a1a70a59c01dfbddfa99f1a5532b9920/73125083969.pdfIn PDF document text
- https://vishalahospitality.com/ckfinder/userfiles/files/99309306863.pdfIn PDF document text
- http://nahar-bd.com/assets/ckeditor/kcfinder/upload/files/18152536034.pdfIn PDF document text
- https://www.crosstownnews.in/kcfinder/upload/files/fakewip.pdfIn PDF document text
- http://qhchemicalsfeed.com/upload/files/temuzisetawobazufoni.pdfIn PDF document text
- http://zhodnoceni-penez.cz/is/images/FCKeditor/File/tonenivowitokefobeb.pdfIn PDF document text
- http://kientrucmoi.com.vn/admin/kcfinder/upload/files/pubixanigigikuvaxolivobo.pdfIn PDF document text
- http://yuanhebiotech.com/upload/files/93619052949.pdfIn PDF document text
- http://krajinar.cz/soubory/files/95683258293.pdfIn PDF document text
- http://protum.se/file/bomedorakujebotoju.pdfIn PDF document text
+10 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00048c98.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x48C98 | 16584 bytes |
SHA-256: e1adb03d93a0773ca76392d7ff636ce9521f3dd7031f89db652c64632e47a7d9 |
|||
font_01_sfnt_off0004b773.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4B773 | 10548 bytes |
SHA-256: 0005dc4d2b7c1913e95402d96ff1d4691af52265a861315eef187428b98a47ff |
|||
font_02_sfnt_off0004cf82.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4CF82 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.