MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One prominent URL, 'https://nipisod.ru/strik?utm_term=briggs+and+stratton+725ex+190cc+engine', suggests a lure related to engine specifications, likely to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=briggs+and+stratton+725ex+190cc+engine PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sugosubexez/sonefuvewutimezilomojefuf.pdfIn PDF document text
- https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_dc8cdfe103df41b08a3f30676526a96e.pdf?index=trueIn PDF document text
- https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_de6284f78bdd44e6ba4672b5de4ba87b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nijudow/66610467469.pdfIn PDF document text
- https://s3.amazonaws.com/lijopavexanuse/what_is_the_programming_language_used_for_coding_arduino_projects.pdfIn PDF document text
- https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_ee2c959f018d4888abd041e37b3e7d73.pdf?index=trueIn PDF document text
- https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_8ad6ac1ba80c478cae27cfebc4e2b410.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bdb424ce-9589-4d69-a2a0-ea5559d6a97e/zakotiru.pdfIn PDF document text
- https://s3.amazonaws.com/xukanomarexumu/listen_to_free_music_online.pdfIn PDF document text
- https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_77741f36006b4719b5cac1de5c227f6d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/votuweroxigezog/oscar_et_la_dame_rose_film_complet_en_franais_gratuit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f09e31b2-5b2e-4240-a3fa-fb90a1e4bf4e/guvumipajizedogur.pdfIn PDF document text
- https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_351ee0c2d5bc4500bae80095492e40ac.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b75b777f-8c18-4e91-b30b-ad6274fbd631/sony_nxcam_hxr-nx100_specs.pdfIn PDF document text
- https://9e1bd277-069e-4713-bdcc-1ab96cf790c3.filesusr.com/ugd/5fd2af_58268c25a849447c8dce0eb41469b4e2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sejakopa/android_9_pie_screen_recording.pdfIn PDF document text
- https://s3.amazonaws.com/kukupunopedon/bharat_all_songs_ming.pdfIn PDF document text
- https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_166dd602dda94ae6b083aafbb4c01680.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/321905cf-2eca-4413-b1a8-22f18152b8db/how_to_bluetooth_connect_to_kenwood_dnx572bh.pdfIn PDF document text
- https://s3.amazonaws.com/dazuxujepov/35902766528.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec839d87-1e3b-4ed1-9d72-e3cde9874638/how_to_use_trimble_business_center.pdfIn PDF document text
- https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_d6e901f331704b71ba78d51d181fea34.pdf?index=trueIn PDF document text
- https://a134ef9b-a212-4d8e-a35f-da3d896bbd40.filesusr.com/ugd/dadc92_52b2ddce2d934dabbfbb26d4be05b2be.pdf?index=trueIn PDF document text
- https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_9a78d4bff55b413ca75168c3ee1543d9.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4b4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4B4 | 5876 bytes |
SHA-256: 368a50635161b115b65af73f456c60795b24d7dd7c338efb97cec4e2f7a7ac73 |
|||
font_01_sfnt_off0000f8da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8DA | 10024 bytes |
SHA-256: 46df9e0f4a8a634b6e49fbdf7c2e79424af099a17fee0bf6cce38a4fa8b3a67e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.