MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, a common tactic for link farms and phishing. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's purpose is to trick users into a fraudulent scheme involving fake prizes or parcels. The presence of embedded URLs and the ML classifier's high score further support a malicious intent, likely related to phishing or scamming.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/award?keyword=anatomy+for+sculptors+understanding+the+human+figure+pdf+free+download
- https://cdn-cms.f-static.net/uploads/4412158/normal_5fd86b7ab146f.pdf
- https://cdn-cms.f-static.net/uploads/4412588/normal_60442f2e7a9f9.pdf
- https://cdn-cms.f-static.net/uploads/4404123/normal_603a69834e3db.pdf
- http://goromeo.club/75749954755d9smg.pdf
- https://cdn-cms.f-static.net/uploads/4413845/normal_604f5a7a846c3.pdf
- https://cdn-cms.f-static.net/uploads/4483071/normal_5fd880c187f75.pdf
- http://uaportal.site/tikipemorupotifokilivizfy8u2.pdf
- https://cdn-cms.f-static.net/uploads/4390323/normal_603594ecd3c62.pdf
- https://cdn-cms.f-static.net/uploads/4446388/normal_5fd1e4a472f55.pdf
- http://balifruit.com/what_order_do_the_weights_in_a_grandfather_clock_goq78m8.pdf
- http://menformula.xyz/dowovozokerafaxogarusaw7r1v.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/33963dca-5616-4304-bd54-8867a763bbad/images_of_organization_charts.pdf
- https://uploads.strikinglycdn.com/files/c837e58f-b1a7-4d02-9f1f-17fecb16bba4/what_is_canon_in_literature.pdf
- https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_04339be5f0e64faba75bbf6b825fb9f5.pdf?index=true
- https://uploads.strikinglycdn.com/files/64a4fddc-9dc8-4097-9de7-664edf350a81/microsoft_wireless_mobile_mouse_4000_not_connecting.pdf
- https://uploads.strikinglycdn.com/files/418b4997-d29c-45a3-9d7c-9d98bfe22989/mebutopiza.pdf
- https://e668d0bc-6b9c-4787-ac64-5363b724ef62.filesusr.com/ugd/6ec699_79a9ac7e0df4496cad98f910213bdb1a.pdf?index=true
- https://uploads.strikinglycdn.com/files/ec114fc1-2f7d-4090-8c5c-a66ffee529e8/20272073101.pdf
- https://uploads.strikinglycdn.com/files/3eddc5dc-e744-4bfd-9ffd-9096d2fbc456/pajonovazijixizoletuj.pdf
- https://uploads.strikinglycdn.com/files/01260420-e327-4577-ba02-3df8047447a0/resiwasu.pdf
- https://uploads.strikinglycdn.com/files/3e5fcb38-f308-48ce-86e9-3285065efe40/mevivesajeru.pdf
- https://a29d81ee-e589-4368-99bd-4e0be04eb4c0.filesusr.com/ugd/a89e6e_8042e43553f44232b8019d0b254bc8c3.pdf?index=true
- https://uploads.strikinglycdn.com/files/854ee55c-ef5b-47fc-9824-28fe6eaf6fe8/bigger_leaner_stronger_calculator.pdf
- https://a24bc4ef-4ee2-4fae-af0c-c9fea810b245.filesusr.com/ugd/67d96c_63a2821769004d0cbc280c0c2814941c.pdf?index=true
- https://84d655c4-d84a-4a0c-9c32-0387925bd622.filesusr.com/ugd/6233da_c29f0e5ec23d438b94ea2e223ff27e52.pdf?index=true
- https://uploads.strikinglycdn.com/files/5aa27d4a-3b24-4887-90f6-c1ea8286f6d7/tuxuzevavuwijudasu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012d46.bine1936c8092372694910b5285f30fb259fc728cdff76e20afe799d0f3d57b826a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12D46 | 5752 bytes |
font_01_sfnt_off000140cc.binf7679998f1501f6326ddc802e1c60197e81360baefc608de989f2224b6c70704 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x140CC | 12320 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.