MALICIOUS
74
Risk Score
Machine Learning
- Nyx PDF Classifier suspicious score 0.4579
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINKPDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ecableapp.com/FCKeditor/FCKimgUpload/file/82648395632.pdf In PDF document text
- https://kingdomofgodmn.org/userfiles/files/22386358385.pdfIn PDF document text
- https://aspart.ro/ckfinder/userfiles/files/28165468876.pdfIn PDF document text
- http://bowlingkillers.com/imgdb/files/68714942595.pdfIn PDF document text
- https://motty-etai-sharon.com/files/files/25322778483.pdfIn PDF document text
- http://ever-pioneer.com/upload/files/bitaku.pdfIn PDF document text
- https://banerjeetourspecial.in/ckfinder/userfiles/files/kipopoputekemelulep.pdfIn PDF document text
- http://ahcxdq.com/uploads/file/270423426414.pdfIn PDF document text
- http://theofficeplus.com/userfiles/file/fazewuroliviwilugegu.pdfIn PDF document text
- http://marcobernini.it/userfiles/files/nuvudipojudopoda.pdfIn PDF document text
- https://fnb-concepts.com/images/uploads/files/mufunafibagunubazebotidir.pdfIn PDF document text
- http://xn--h1agcmh.com/ckfinder/userfiles/files/tezipakegemilezofak.pdfIn PDF document text
- https://pui-vital.ro/msg_media/file/wesog.pdfIn PDF document text
- https://altinone.cz/files/ckfiles/file/rejom.pdfIn PDF document text
- http://sovet.kovrov-gorod.ru/uploads/custom/file/25040366052.pdfIn PDF document text
- http://roocenter.ru/upload/file/45322404301.pdfIn PDF document text
- http://terrigena.cz/data/pic/files/xafowob.pdfIn PDF document text
- http://weforyou.it/userfiles/files/40340295554.pdfIn PDF document text
- http://ecogestval.es/userfiles/file/kawerirelusowebome.pdfIn PDF document text
- http://bandenplaats.nl/cmsimages/file/81658000874.pdfIn PDF document text
- https://saksisan.com/upload/ckfinder/files/tejimenagerezugutasimefob.pdfIn PDF document text
- https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/md9gs7l2j2s8ith9ne6b4dh4ve/2570444345.pdfIn PDF document text
- http://vdtonline.vn/static/uploads/editor/files/59291759691.pdfIn PDF document text
- http://anke.de/data/anke.de/uploadfiles/file/60052565995.pdfIn PDF document text
- https://alfamar.travelshops.pl/userfiles/file/43048662975.pdfIn PDF document text
- https://netcsemege.elelmiszer-hazhozszallitas.hu/ckfinder/userfiles/files/medugujav.pdfIn PDF document text
- https://gatheritup.com/js/kcfinder/upload/files/54915733917.pdfIn PDF document text
- https://www.eecpowerindia.com/codelibrary/ckeditor/ckfinder/userfiles/files/figetoneg.pdfIn PDF document text
- http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/16207b387d6cb0---51487504966.pdfIn PDF document text
- http://wtmongolia.com/materials/file/83689333413.pdfIn PDF document text
- http://matras-devison.com/upload/file/nejasozobigujir.pdfIn PDF document text
- https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/1621632af8e476---7609677881.pdfIn PDF document text
- https://colod.co.za/XSRYdR1H?utm_term=adblock+free++for+androidPDF link annotation
- http://andersen-racing.com/pictures/editor/files/66869861876.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00069c0c.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00069c0c.bin)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00069c0c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x69C0C | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_01_sfnt_off0006b32c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B32C | 10416 bytes |
SHA-256: c9ee98279d3bc747d1487b3d235de7263678298fd7f57b3b8390fce6520f466a |
|||
font_02_sfnt_off0006cad2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6CAD2 | 16336 bytes |
SHA-256: adf38969d40f501586e0caf93d33991e243baeeecfe575c4831cdbf64b7044fa |
|||
font_03_sfnt_off0006e0d0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6E0D0 | 20044 bytes |
SHA-256: 88530c5cee60bd70dfd8ec892d81558d8f18624e37fa0c4009ec93e9ee06686e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.