MALICIOUS
204
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it contains a mass external link farm and lures the user to install a browser extension or update. The primary malicious URL identified is 'https://lozipotod.ru/wix?keyword=chrome+apk+downloader+android', which is likely used to host or redirect to the malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9945
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/wix?keyword=chrome+apk+downloader+android
- http://mangalvpodarok.ru/what_great_teachers_do_differently_ebooko7h2m.pdf
- https://cdn.sqhk.co/zoxowowi/Tdibuig/dogixugikoni.pdf
- https://cdn.sqhk.co/pigevikuwi/id0gghb/ball_shooter_for_dogs.pdf
- http://nuveclovet.xyz/63872326563jy2ey.pdf
- https://cdn.sqhk.co/fenazijeguk/9ibgjjb/dragon_ball_fighterz_arcade_stick_xbox_one.pdf
- https://cdn.sqhk.co/sipebesoxu/CbT1ghp/everfi_module_5_credit_scores_answers.pdf
- http://jozipuvuwuzaj.mywebcommunity.org/what_is_license_document_number.pdf
- http://kismyketio.com/94878167354ekqzj.pdf
- http://palubofapejuraw.mywebcommunity.org/25922207874.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_c942e104bdc844cfb896eb6235d02023.pdf?index=true
- https://5f384421-c3d0-4b4c-85a6-d3745974446f.filesusr.com/ugd/40006b_24015a7d3dcc4859b3e75bfbeedb448b.pdf?index=true
- https://s3.amazonaws.com/lixuzo/odd_thomas_cazador_de_fantasmas_trailer_espaol.pdf
- http://vasakuzepilaxi.onlinewebshop.net/abbyy_finereader_to_word_converter.pdf
- https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_155137fb096a4af4a079b81a45f4d2a0.pdf?index=true
- https://78151a86-a557-4e49-81aa-a2539eea45c7.filesusr.com/ugd/204f4f_0bb1f93af47b482d82ef5c29266e1e3c.pdf?index=true
- https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_11af6ab58bb54adf9dcd473d1b31cd2d.pdf?index=true
- http://bugenerefajujus.atwebpages.com/46539436989.pdf
- https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_cef30b2ee1494b5aab7086c1fec77379.pdf?index=true
- https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_c2def740d23c4a9d9f232fece2f9e703.pdf?index=true
- https://s3.amazonaws.com/towakog/antenna_tv_channels_program_guide.pdf
- https://s3.amazonaws.com/wibedubosateg/download_gambar_asmaul_husna_satu_persatu.pdf
- https://s3.amazonaws.com/zunewidimem/63191708277.pdf
- https://5ac9d038-517d-4536-97f6-676423289421.filesusr.com/ugd/b444d4_76474647bd7b4909a5a2a02da4ee783e.pdf?index=true
- https://77abcf6a-1f47-4233-a5f7-28832101be0a.filesusr.com/ugd/e29e5c_7cf2d334a10d4982bd660f526c329e1d.pdf?index=true
- http://rewuwuja.onlinewebshop.net/17453234011.pdf
- https://s3.amazonaws.com/jemazejodep/cartoon_serial_site.pdf
- https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_4cd6678b9da34a6bb2ce6f9b27063feb.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off000140ff.bine7af1b4e53aa5f35af40e19d2aad06961e6ae5ecfb66b41fa13d24cc0fceb98f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x140FF | 31128 bytes |
font_00_sfnt_off00010925.bin80e9f136199c13d0f06baac5bd4879a58d117d2b69dc611edce33c4571ba1bfe |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10925 | 5084 bytes |
font_01_sfnt_off00011a4c.binbd2789e55cd25ef97c4a87f17d96bc84fc318acde0b5aac9cfe1351c464fa214 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A4C | 11400 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.