MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded links, with a primary focus on redirecting users to malicious domains such as 'yafferge.ru' and 'italy50wow.pro'. These links are presented in a way that suggests they are search results, likely to trick users into clicking them. The presence of numerous links on disposable hosting and the use of UTM parameters indicate a phishing or scam attempt. No scripts were extracted, but the PDF structure itself facilitates the malicious redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/strik?utm_term=husqvarna+455+rancher+parts+ebay In PDF document text
- http://italy50wow.pro/fgo_friend_point_summonybaa5.pdfIn PDF document text
- http://simcars.ru/14882314934owpe5.pdfIn PDF document text
- http://astrology-personal.online/orchestra_video_mp4m45mk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402478/normal_5fd88bbdcaa48.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488569/normal_60371bf39db80.pdfIn PDF document text
- http://redtea.space/nuwawejj8m7.pdfIn PDF document text
- http://gewewenaso.iblogger.org/quaid_e_azam_university_form.pdfIn PDF document text
- http://rerubin.space/descargar_biblia_cristianam6gfy.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_7f5bed7000004e9484dce9505e2a54c0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3fbe07fd-de3b-4949-8371-b97a89cff22e/what_does_convicted_by_god_mean.pdfIn PDF document text
- http://tajevivolup.epizy.com/icb_credit_report_ireland.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4507748-30c0-445e-913e-9d13066e89f1/scientific_method_worksheet_year_7.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbb8b819-8e5c-4835-b98e-06357c1e4e07/bose_companion_2_series_iii_multimedia_speaker_system_pc.pdfIn PDF document text
- https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_6da76ee35aa8484a9a66c344bce7cce5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b5037727-d44b-43da-b484-de7c84d82ddd/bodivuzu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd1e26b1-6ba9-4ca7-bea5-25dff4552c49/how_to_use_mpc_essentials_as_a_plugin.pdfIn PDF document text
- https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_901bdbd99ea24571ab248b02990aaab5.pdf?index=trueIn PDF document text
- https://ab9101c8-a046-40a0-ba79-761bab9f3367.filesusr.com/ugd/61fb7c_0a89847f4647477188d50d1d9afe1098.pdf?index=trueIn PDF document text
- https://592908bf-dd96-48cc-88d9-ffebbdd10d84.filesusr.com/ugd/f34823_26d6d80bfd2747a990bbeb67b6631ec4.pdf?index=trueIn PDF document text
- https://52a1af19-6946-4c37-aba6-ab00a30e4874.filesusr.com/ugd/5dc3ca_35e2c40ad4bb44cabefe00da6d29af5c.pdf?index=trueIn PDF document text
- https://9fd063f5-a6e2-47f0-a1c8-15c646e36cc9.filesusr.com/ugd/ee11ea_af6e43f57d9d4bb89763f6f4fc988e9c.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e728.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE728 | 5592 bytes |
SHA-256: 9e33c85adb58766f26f57bd1fa550447b8b264a64190d7504d2b92400e308a2c |
|||
font_01_sfnt_off0000fa40.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA40 | 10644 bytes |
SHA-256: 1df9c3440f410d1635744e7a7985fbd9d0c8d433fed5ede06dc11bd5b1d48cfa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.