MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple links, with one identified as a known malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of numerous external PDF links suggests a link farm or redirection strategy to distribute malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9983
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/strik?utm_term=al+mathurat+transliteration+pdf
- https://buwefube.weebly.com/uploads/1/3/0/9/130969915/jomeluxaguto-gajelemexomono-metefojapivix-dabew.pdf
- https://cdn-cms.f-static.net/uploads/4421061/normal_606cc646836f2.pdf
- https://wogakidip.weebly.com/uploads/1/3/5/3/135384189/2700202.pdf
- https://zerexiborugixa.weebly.com/uploads/1/3/4/7/134705556/7032812.pdf
- https://cdn-cms.f-static.net/uploads/4401973/normal_606990fcb0cae.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/9cb99e90-08ec-4004-9e6e-f65b555a7f43/how_many_calories_in_a_supreme_taco_from_taco_bell.pdf
- https://uploads.strikinglycdn.com/files/06dea0b1-4db4-4d7b-b8d3-369775a1d224/86018463981.pdf
- https://uploads.strikinglycdn.com/files/ed97e1bb-43ec-4745-ad80-0ae16d0f8a21/removing_rubber_seal_on_lg_washer.pdf
- https://uploads.strikinglycdn.com/files/d7a0e964-427c-43a1-b4c8-6a994ffde020/70781619003.pdf
- https://uploads.strikinglycdn.com/files/93d3d7e9-95b0-4836-8656-30925b93936e/kepemavibowigedefara.pdf
- https://uploads.strikinglycdn.com/files/c73bcb91-72a9-4ab7-8379-82145ce8e84d/kavevotifilorusatogaperez.pdf
- https://uploads.strikinglycdn.com/files/7d94784c-c905-4a10-9cfd-bfcf7b4f7e57/what_jobs_can_you_get_with_a_public_speaking_degree.pdf
- https://uploads.strikinglycdn.com/files/532cf736-db73-4d47-99ec-81eb497d3ed7/is_irregular_at_magic_high_school_finished.pdf
- https://uploads.strikinglycdn.com/files/d047c3e4-00c1-4126-b85b-0d59ad77a91e/origin_of_species_in_hindi_download.pdf
- https://uploads.strikinglycdn.com/files/5caf14b1-c683-480c-ae7d-2f8c13804201/what_is_the_wavelength_range_of_uv_light.pdf
- https://uploads.strikinglycdn.com/files/ef3b1044-5e77-4de2-8d52-ad1ae9d67040/zexidulazilo.pdf
- https://uploads.strikinglycdn.com/files/496cc8cf-5e32-4362-902b-d251dfbd22ca/hackmaster_4th_edition_character_sheet.pdf
- https://uploads.strikinglycdn.com/files/64ec27c9-5e32-4dd1-bf3c-63edf2b9e4c2/53809434375.pdf
- https://uploads.strikinglycdn.com/files/97816dd8-20f7-4197-9143-6dc543d7ce6d/diagrama_de_clases_uml_relaciones.pdf
- https://uploads.strikinglycdn.com/files/ab243208-1eff-4e5d-85f8-dd336db65c5f/self_esteem_activities_for_adults.pdf
- https://uploads.strikinglycdn.com/files/40809c0e-5b35-486c-8b75-7ef6cead7d76/gta_vice_city_cheats_hack_android_apk.pdf
- https://uploads.strikinglycdn.com/files/3b47c6eb-d93e-46a4-8d5f-e5427b4b0c5a/rekekawuwasipowafap.pdf
- https://uploads.strikinglycdn.com/files/c67ec72f-ae6d-4a09-9768-c3a21273dbb0/77667387920.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f058.binaa02bc153af04383392db948e9d9f8a6ba3f9d1e9d617b908f250594b0da3930 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF058 | 5152 bytes |
font_01_sfnt_off000101ae.bin0f2db1b14f9c3cc4919bfe8d3fe5b51c5c7c9e996ea20b6b0d3fbe7b808d879c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101AE | 10692 bytes |
font_02_sfnt_off0001265b.bin39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1265B | 16092 bytes |
font_03_sfnt_off00013b22.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13B22 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.