MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded links, many of which point to disposable hosting or unknown domains, indicating a link farm designed to redirect users. The presence of the URL 'https://gimoguvi.ru/award?keyword=cardiomegaly+adalah+pdf' and the ClamAV detection 'Pdf.Phishing.Trojan' strongly suggest a phishing or malicious redirection attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious document, likely delivered via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/award?keyword=cardiomegaly+adalah+pdf PDF link annotation
- http://teachost.com/8116035794gnusy.pdfIn PDF document text
- http://spiritstudio.ru/dufixazolupize43d9.pdfIn PDF document text
- http://bettermoneytips.com/bhavesh_joshi_full_hd_movie_filmywapl8k99.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_a83e355910a646cdae0dfdad22a4f8fd.pdf?index=trueIn PDF document text
- https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_327d72d2f52746b2ba7feeb64a9bbf41.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bc577ac8-901d-4bc4-a536-7cef82903f57/best_storyboard_app_android.pdfIn PDF document text
- https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_838ca300e8874517bf8fb9665273dfe9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6ef4c3e2-8f5b-4066-b3ff-3d84298f0388/how_to_upload_images_on_google_photos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad7bfdc6-5d49-4a8a-a57b-26d94f7df86e/stihl_leaf_blower_bg56c_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a9b9f841-3391-40fa-b9b6-b2343f2d15a6/3755211238.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a23733d5-d772-445e-8d45-b103575f94c8/what_does_the_bible_say_about_adultery_in_marriage.pdfIn PDF document text
- https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_af189a75ec4e481dab92bd904f2956e6.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sepovutapakogaf/work_song_cannonball_adderley.pdfIn PDF document text
- https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_99f17ecdf9404577b04d1a0b208f70a9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pafexegud/ellipsis_7_tablet.pdfIn PDF document text
- https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_f8279b2823704a23a262c104174b8195.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7657f5ef-05fd-4180-90b3-e59453ac46a7/zudifevubixabawenupumifi.pdfIn PDF document text
- https://1a6defe7-92a0-4357-8a70-d3bce85d30c9.filesusr.com/ugd/385065_c24054b81f0a4763a69c1510dc1c3396.pdf?index=trueIn PDF document text
- https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_2981604ff291430bac0b18c681f6be52.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010914.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10914 | 5284 bytes |
SHA-256: b3662c99a74ecdd2c8bd9285204c79c4b6a3180ead9fafb35a103232d8c523c8 |
|||
font_01_sfnt_off00011ae8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AE8 | 11896 bytes |
SHA-256: a072e9a8c4b22f74ea071aa94b163da658ed0ef0637f95b03a5878afb9cb3529 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.