MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, directing users to numerous domains, with a high concentration of links on disposable hosting. The embedded URLs suggest an attempt to redirect users to malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9870
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://implantsdentairesdesmoulins.com/upload/editor/file/5725631135.pdf In PDF document text
- http://gavinlawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/49250664956.pdfIn PDF document text
- http://colorsoftexas.com/ckfinder/userfiles/uploads/dexufirenejogawajet.pdfIn PDF document text
- http://gjbbang.com/userData/board/file/44558196158.pdfIn PDF document text
- http://busto-wl.gattinonimondodivacanze.it/themes/userfiles/files/xisovemuvoxetep.pdfIn PDF document text
- https://orderpoet.com/ckfinder/userfiles/files/bigov.pdfIn PDF document text
- http://topnotchimports.com/ckfinder/userfiles/files/walitegedufadipizano.pdfIn PDF document text
- http://nuklearmedizin-amro.de/userfiles/file/ravotijufusunogu.pdfIn PDF document text
- http://zeguvietnam.com/uploads/ckfinder/files/97306495563.pdfIn PDF document text
- http://telekommarketing.com/firme_data/files/17201638483.pdfIn PDF document text
- http://nomorecpapmachine.com/userfiles/files/64829278826.pdfIn PDF document text
- http://dissanna.com/temp/fckeditor/file/murota.pdfIn PDF document text
- https://dudikom.pl/userfiles/file/topogegozopuw.pdfIn PDF document text
- http://thewellmanteam.com/userfiles/files/bojalejute.pdfIn PDF document text
- http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/161305af4db015---84986153233.pdfIn PDF document text
- http://www.gamylai.vn/uploads/files/lotenoponeromubo.pdfIn PDF document text
- https://jasmijnbloemengroen.nl/userfiles/file/nuzubizo.pdfIn PDF document text
- http://alwaysshine.com/fileimage/file/bowivekatobaludawivogepe.pdfIn PDF document text
- https://www.edm-medical.net/ckfinder/userfiles/files/21370131041.pdfIn PDF document text
- http://sms-dk.com/FileData/ckfinder/files/20210914_4E3ACD40D6AA42AF.pdfIn PDF document text
- https://pixel.bg/img/file/62413976810.pdfIn PDF document text
- http://hamkr.com/userData/board/file/xazepebopukir.pdfIn PDF document text
- https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135d26b64989---29030623273.pdfIn PDF document text
- https://marblobaths.ph/app/webroot/img/files/95751062615.pdfIn PDF document text
- http://sbairs.com/datas/files/wewataw.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=le+mythe+de+sisyphe+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_006_off0001be63.bin21108830f7198d5f727a323d84b0e0d6d92371f11c84bcc830658cc4678cb276 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1BE63 | 18224 bytes |
font_00_sfnt_off0001525c.bin85134f057ec3bcf55482da243077cd3812e57f8eff4ae1abc8cd30342197bf5a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1525C | 24516 bytes |
font_01_sfnt_off00018f1b.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18F1B | 16792 bytes |
font_02_sfnt_off0001a732.bine407b01bb21301bb104638f5944372c0b74481fb8b5681aa2666f408e106d7c0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A732 | 10300 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.