MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains numerous embedded URLs, with a primary suspicious URL pointing to a site that appears to be a link farm designed to redirect users. The presence of a disposable hosting link farm and the overall structure suggest a phishing attempt to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9976
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=korg+kaossilator+pro+manuale+italiano PDF link annotation
- https://cdn-cms.f-static.net/uploads/4368736/normal_5fd97e99ab9ee.pdfIn PDF document text
- http://mosquito.codes/39403357286zd920.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448347/normal_5fc612f83db0b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422637/normal_6011ecba2899d.pdfIn PDF document text
- http://mifvideo.space/ahsoka_tano_voreul09o.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483104/normal_603a738641da1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446492/normal_601d56f8d30fc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4468255/normal_5ff52c1ca68a2.pdfIn PDF document text
- http://rivesoguteve.22web.org/xoxorukosinezovixa.pdfIn PDF document text
- http://presalle.xyz/surah_mulk_english_translationsc9n7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478125/normal_605cad7fd5f2a.pdfIn PDF document text
- http://tanifulumu.iblogger.org/39002398082.pdfIn PDF document text
- http://gisowutuxa.22web.org/how_do_you_update_a_garmin_nuvi.pdfIn PDF document text
- http://lotusedafefuwi.22web.org/rabopibisodazadurakoteju.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/61374c61-c4bd-410c-a6d6-d5da6d4ec7f8/purerupazega.pdfIn PDF document text
- http://pakewerulawe.rf.gd/33437263049.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba19dd35-899c-4862-a644-e89c0a714cee/18331914841.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7cc2b179-5076-46f2-bd98-1f363b0ddca6/21175899190.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0859bc5-318e-4ad6-97f5-2fb5ce10d2f4/descripcion_de_los_personajes_mi_planta_de_naranja_lima.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90f7e2e2-0878-4f29-beac-4f1bb53d676c/the_magicians_season_4_episode_10_imdb.pdfIn PDF document text
- http://rawonisobux.rf.gd/improve_confidence.pdfIn PDF document text
- http://besogigususatu.epizy.com/41819596786.pdfIn PDF document text
- http://xerotoxivedeme.epizy.com/nsp_bonafide_certificate_download.pdfIn PDF document text
- http://bokakemipik.epizy.com/best_small_cars_2018_consumer_reports.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012d31.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12D31 | 5052 bytes |
SHA-256: b33937ca96739d8e76abd52eb21de67c475f377b39deba1eb07d8b040abaf5c8 |
|||
font_01_sfnt_off00013e4e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13E4E | 14124 bytes |
SHA-256: f4899c0b9266a8b099efab555ca7b728fac20a24b6902e0c8629123c584432b2 |
|||
font_02_sfnt_off00016a0e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16A0E | 16204 bytes |
SHA-256: c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449 |
|||
font_03_sfnt_off00017f3d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17F3D | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.