MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a common tactic for SEO link farms and phishing. One prominent URL, 'https://resalured.ru/strik?utm_term=anatomy+and+physiology+coloring+workbook+answers+chapter+5', suggests a phishing lure related to educational content. The presence of ClamAV detection and ML flagging indicates malicious intent, likely to redirect users to malicious sites or download further payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=anatomy+and+physiology+coloring+workbook+answers+chapter+5
- https://vosaxoro.weebly.com/uploads/1/3/4/4/134469305/b02fe8c2d83.pdf
- https://cdn-cms.f-static.net/uploads/4421354/normal_6041f6ce83a58.pdf
- https://cdn-cms.f-static.net/uploads/4417315/normal_6034de0fc2f03.pdf
- https://nirasiban.weebly.com/uploads/1/3/4/3/134344158/4851084.pdf
- https://cdn-cms.f-static.net/uploads/4387229/normal_60691b09a0201.pdf
- https://gelurojaf.weebly.com/uploads/1/3/4/6/134697462/genat_tojupatetodati_pipiwafimize.pdf
- https://bakogala.weebly.com/uploads/1/3/1/3/131384254/jolimupap.pdf
- https://noragunefide.weebly.com/uploads/1/3/1/6/131637841/7280420.pdf
- https://cdn-cms.f-static.net/uploads/4409413/normal_606e0035e437f.pdf
- https://femomupine.weebly.com/uploads/1/3/4/4/134458898/wexepedowewojuwu.pdf
- https://bodonejuw.weebly.com/uploads/1/3/4/6/134686214/b3f9b252878.pdf
- https://cdn-cms.f-static.net/uploads/4465393/normal_5fd17f1d2539e.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/fdee113c-ac0b-4655-ade2-6a0cff1faa46/is_artemis_fowl_good_or_evil.pdf
- https://uploads.strikinglycdn.com/files/69ba5b6e-9a05-4118-a638-7fcde57f550c/pobirozitokizakidofu.pdf
- https://uploads.strikinglycdn.com/files/af1c9343-ebee-447f-ae62-5f7542c9a6b0/do_skullcandy_hesh_2_work_with_xbox_one.pdf
- https://uploads.strikinglycdn.com/files/723b9af6-446e-4e3f-9fcd-6baafb769d06/how_do_i_connect_my_echo_dot_3rd_gen_to_wifi.pdf
- https://uploads.strikinglycdn.com/files/7e6b1de0-dceb-43c0-af63-23ff012b5394/maytag_bravos_washer_reviews.pdf
- https://uploads.strikinglycdn.com/files/ec07f24a-4dce-40e1-8232-715838074199/physics_solution_class_11_chapter_4.pdf
- https://uploads.strikinglycdn.com/files/e96c618b-c020-4351-805a-2c2b9e5c463e/safety_first_everfit_car_seat_reviews.pdf
- https://uploads.strikinglycdn.com/files/79df404c-36f7-456b-970f-aece6bbcee1d/10781185419.pdf
- https://uploads.strikinglycdn.com/files/b34bf797-8f80-44c3-a203-72f1c0b8ae12/wuwobe.pdf
- https://uploads.strikinglycdn.com/files/382836b9-3b85-4a56-a148-809d6629cb4c/can_you_reverse_search_a_cell_phone_number.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d4a2.binee4951165314afd975d131998a2c029f4dc9080b03176cd93faa9ea4a21de6d2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD4A2 | 5996 bytes |
font_01_sfnt_off0000e900.bind762d814ac24ab169acfb4ceb5011dfb211c3fdd913d06a8a5a8ee36d5a003ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE900 | 10584 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.