MALICIOUS
114
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is a PDF document that contains embedded JavaScript and a high-confidence heuristic for a redirector link. The embedded JavaScript and the external URI point to a URL that is flagged as a free-download phishing lure. This suggests the document is designed to trick the user into visiting a malicious site, likely for credential harvesting or further malware delivery.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4343
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://sunuf.co.za/XSRYdR1H?utm_term=walter+chilambo+new+song PDF link annotation
- https://path.mn/userfiles/files/rolisiwuzumepusepovok.pdfIn PDF document text
- http://happyhanool.com/ckupload/files/82123883327.pdfIn PDF document text
- http://www.lugashotel.com/data/editorfile/xezebixiroxutuwefuko.pdfIn PDF document text
- http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1610d9f858bd01---31683508906.pdfIn PDF document text
- http://phutungototuanphat.com/img-tvdl/files/gujogafozinemofumexol.pdfIn PDF document text
- http://righetti-ticozzi.it/userfiles/files/86735911823.pdfIn PDF document text
- https://chennothinterios.com/uploads/file/98343570370.pdfIn PDF document text
- http://downtowncincyhotels.com/core_degree/admin/images/cms_imagesfiles/sabemenuvogow.pdfIn PDF document text
- http://soft-pro.hr/upload/datoteke/72557609238.pdfIn PDF document text
- http://langmoon.jp/js/upload/files/36748270527.pdfIn PDF document text
- http://waterreducer.cn/d/files/83154598351.pdfIn PDF document text
- http://healhumanity.foundation/userfiles/file/57554766442.pdfIn PDF document text
- http://trevorhannant.com/41196337134.pdfIn PDF document text
- https://pmcp-avac.com/files/upload-ckfinder/files/nuniwisopuj.pdfIn PDF document text
- http://como.gattinonimondodivacanze.it/themes/userfiles/files/75331336382.pdfIn PDF document text
- http://ck-kutnahora.cz/gais/image/file/ropazobalawipawe.pdfIn PDF document text
- http://esistore.de/userfiles/file/15892928901.pdfIn PDF document text
- http://escolacaritas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1618fb3238e61c---kuwaritezaturubujet.pdfIn PDF document text
- http://sun-tes.ru/files/file/wukenudirusemugugikudetuk.pdfIn PDF document text
- https://kuepancong.com/contents/files/sujobe.pdfIn PDF document text
- http://escalierdurire.fr/ckfinder/userfiles/files/melaxukajumamumeroluzera.pdfIn PDF document text
- http://020tzs.com/baige/images/userfiles/file/15362840305.pdfIn PDF document text
- http://anhbanglaw.com/userfiles/file/33064719749.pdfIn PDF document text
- http://www.deco-interieure.com/userfiles/file/turomowawol.pdfIn PDF document text
- http://www.klub112.cz/upload/files/39316139475.pdfIn PDF document text
- https://highfieldhousehotel.net/nbloom/fckuploads/file/vudariwan.pdfIn PDF document text
- http://cualuoihoanmy.com/uploads/userfiles/file/jisekiwexidilezisa.pdfIn PDF document text
- http://aksaxena.com/bpms/includes/fckeditor_uploads/userfiles/file/juturujuwigovalirobizuso.pdfIn PDF document text
- http://afinamebel.ukrkarta.ua/fckeditor/userfiles/file/fejujimodefuvererimo.pdfIn PDF document text
- https://satbietthu.com/luutru/files/10068054366.pdfIn PDF document text
- https://karapinarinsaat.net/userfiles/upload/file/99997916219.pdfIn PDF document text
- http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611091a1d23f3---84540348746.pdfIn PDF document text
- http://vlaamspatientenplatform.be/_plugin/ckfinder/userfiles/files/poxelinewixogovo.pdfIn PDF document text
- https://istanbularicilikfestivali.com/upload/ckfinder/files/69937402070.pdfIn PDF document text
- https://suavitinhtannha.net/upload/files/58482412919.pdfIn PDF document text
- http://stickers-moins-cher.com/userfiles/stickers-moins-cher.com/file/91376366974.pdfIn PDF document text
- https://mujeresenmovimientoplus.com/userfiles/file/wilogevuba.pdfIn PDF document text
- http://papianiarch.it/userfiles/files/bebufowar.pdfIn PDF document text
- https://www.kazaviaspas.kz/app/webroot/js/kcfinder/upload/files/virajefadili.pdfIn PDF document text
- https://lacaune.hu/userfiles/file/furonab.pdfIn PDF document text
- http://prunay-en-yvelines.fr/ckfinder/userfiles/files/foviva.pdfIn PDF document text
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/16117083ee6d9b---notokis.pdfIn PDF document text
- http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/sbfd3td9q4doe48obnk8ib9ac2/xenukavitumebup.pdfIn PDF document text
- http://chapraptti.org/userfiles/file/93843519411.pdfIn PDF document text
- http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/g0mcjv5odglnjur34k6hdvcmv7/fiwafo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
+4 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00085bb0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x85BB0 | 10896 bytes |
SHA-256: 17a213f3c1097073cb438f8af0641fc11c33a4f80dd6cd51ac585834a1d99d60 |
|||
font_01_sfnt_off000874c6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x874C6 | 16560 bytes |
SHA-256: b029b1d8d3e6fd6fe8ea8e2565b89adafdcab654e532cd36cea4a8ef82fc9039 |
|||
font_02_sfnt_off00089fd4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x89FD4 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.