MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains numerous links to external domains, many of which are identified as part of a link farm on disposable hosting. The heuristic 'PDF_RANDOM_URL_LINK' specifically points to a suspicious URL that likely serves as a download or redirect for malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9982
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://deforma.it/userfiles/files/72165168019.pdf In PDF document text
- http://telecycling.info/files/file/19416694219.pdfIn PDF document text
- http://bogaarchitetti.it/userfiles/files/nawogaxuv.pdfIn PDF document text
- http://www.pzkexie.com/up_files/file/mokedinitumuwaxi.pdfIn PDF document text
- http://goldendoodlesofthesierranevadas.com/userfiles/file/nofanuravonibomovuki.pdfIn PDF document text
- http://nt-module.ru/ckfinder/userfiles/files/74215704970.pdfIn PDF document text
- https://advance-pack.com/editor_upload/file/dopekuxe.pdfIn PDF document text
- http://waypl.pl/upload/File/7465795085.pdfIn PDF document text
- http://spadhotel.com/basefile/spadhotelcom/files/64873524089.pdfIn PDF document text
- http://chithanhplastics.com/uploads/userfiles/file/91764686489.pdfIn PDF document text
- http://trans-serwis.com/userfiles/file/3545502273.pdfIn PDF document text
- http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1614707d041b16---68778686047.pdfIn PDF document text
- https://ichapps.com/ichapps/ckeditor-ckfinder-integration/uploads/files/pidizavonudeberekunakexe.pdfIn PDF document text
- http://pc580.cn/upload_fck/file/2021-9-6/20210906211339131597.pdfIn PDF document text
- http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/1613ec1b48ad72---sovupa.pdfIn PDF document text
- https://wegofa.com/userfiles/file/fabodunekukasulepivolu.pdfIn PDF document text
- https://mariellatriolo.it/public/file/damamenidenenafajem.pdfIn PDF document text
- https://rh4-h1tapi-turbo.com/contents/files/65392068810.pdfIn PDF document text
- http://contrast.no/ckfinder/userfiles/files/79109808907.pdfIn PDF document text
- http://nineslash.com/user_file/file/13369693690.pdfIn PDF document text
- http://volkshilfe-ktn.at/images/content/files/81477072363.pdfIn PDF document text
- https://bnovum.hu/downloads/98301084734.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=power+rangers+legacy+wars+mod+apk+downloadPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b410.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB410 | 14500 bytes |
SHA-256: d1ac3d3df4672ce81f501fbb268ba795b0b04bd742ea94195705085233e9e085 |
|||
font_01_sfnt_off0000d8b8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD8B8 | 10960 bytes |
SHA-256: 386e8a4e84a98d76d77722a5e37ef1c44889f0acab51ac443d2822eb06ab8e35 |
|||
font_02_sfnt_off0000f20a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF20A | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.