MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains a large number of external links, including a suspicious URL related to 'nude pics of christina anstead' and a link to another PDF, suggesting a link farm or redirection to malicious content. While no scripts were explicitly extracted, the PDF structure and the nature of the embedded links strongly indicate a phishing or malicious content delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://medvor.ru/pbw?utm_term=nude+pics+of+christina+anstead PDF link annotation
- https://static.s123-cdn-static.com/uploads/4500910/normal_5fe2c2671cc21.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465387/normal_602812cef2894.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4530457/normal_6056ba9d22e2c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4415756/normal_600250218ab4f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421614/normal_60011c815c517.pdfIn PDF document text
- https://tenipimip.weebly.com/uploads/1/3/4/0/134042327/5785937.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4386621/normal_5fc6b6e156b83.pdfIn PDF document text
- https://kivasemav.weebly.com/uploads/1/3/2/6/132680863/4602754.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426059/normal_5fef4e0c14e2a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409998/normal_60276950d1f03.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367279/normal_60162da34b769.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384145/normal_5fd17dfb8f97c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410018/normal_6064b5e9d5910.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/e9664007-0066-48f2-be61-da487e569ddb/libro_de_matematicas_2_de_secundaria_contestado_savia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f8ae4dd-df83-4817-af10-6854e362f362/how_to_help_struggling_readers_in_first_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7a9873f7-44e6-4896-845f-c8ff11a384b2/51516051165.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69747192-8425-4280-95d5-e78bb5bb598a/how_the_grinch_stole_christmas_book_read_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a53e27a-6c99-429b-9641-82a195736357/how_much_do_crime_scene_investigators_get_paid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16f468a2-43cb-4b06-bf7c-284cd7c683ed/why_is_the_red_light_flashing_on_my_panasonic_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4506a164-8f84-4f7d-b6a2-3aaed6a7685f/cessna_182_illustrated_parts_catalog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2b8d0e2-a2f9-4166-a640-49b376e59e0a/fakaxamapagigelo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbc12b13-9569-427f-b42d-e35c1cf39a61/wetov.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dfd2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFD2 | 5180 bytes |
SHA-256: 23658cd0ff1dd127be279bf78f35a17522d52e44a00a9a4735d87ab27335976e |
|||
font_01_sfnt_off0000f16c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF16C | 4640 bytes |
SHA-256: 83330439c7d1cb7b71125d67dbae7dee24a863bbf539dd6bd6f884d48577c3ad |
|||
font_02_sfnt_off0000fe0e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE0E | 11104 bytes |
SHA-256: 31196c389372509a00d4ea86bfd95b69ed3298ad205478ce578691e777b987f5 |
|||
font_03_sfnt_off0001245b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1245B | 16036 bytes |
SHA-256: 9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.