MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to 'allytemp.ru', which is likely a malicious domain used to host a phishing page or download further malware. The document body, though heavily obfuscated, appears to be a lure related to 'Atlas Copco compressor parts list', suggesting a targeted phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allytemp.ru/pbw?utm_term=atlas+copco+compressor+parts+list PDF link annotation
- https://static.s123-cdn-static.com/uploads/4447646/normal_5ff382cf3683e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378608/normal_6043ed47d56eb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4486563/normal_604dbbf5b9e4b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369651/normal_5fd6376c14050.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4387428/normal_60b116a1ca5a8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4412758/normal_600945727c3b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4475854/normal_6056f2f47f2a5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448991/normal_60210fe724853.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489850/normal_5fe5366505d8c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/096082b0-e332-4c47-8918-d7376fc5dbcc/10923589706.pdfIn PDF document text
- http://sewafebi.pbworks.com/f/whatever_a_man_thinketh_so_is_he_niv.pdfIn PDF document text
- http://rixepal.pbworks.com/w/file/fetch/144520602/60705078216.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6b146be-8c32-4f45-bff7-955a042c0723/3114308763.pdfIn PDF document text
- http://zezimin.pbworks.com/f/gajutatudi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5ed572f-03d2-4132-a475-e171dcf497e1/bhaag_milkha_bhaag_mp3_download_songs.pk.pdfIn PDF document text
- http://xalanupuzewo.pbworks.com/w/file/fetch/144419598/69222612279.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eff28e2f-5326-446c-a3b0-a91e1deeb7e0/lowrance_mark_4_hdi_fish_finder.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e4b0428-646e-4600-a92f-a35a08078107/zosabuzijewewuz.pdfIn PDF document text
- http://bepisoxu.pbworks.com/w/file/fetch/144440091/simple_business_lease_agreement_template_south_africa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d0477fe-6be7-4c96-a926-74f3186c206f/enrique_bailando_mp3_free_download_320kbps.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9cfd14bb-7c17-4993-9e05-1830e0f76068/how_to_train_your_dragon_movie_and_show_order.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dda5aaa6-3a92-4999-a7f3-7dd58519b43a/quotas_navy_advancement_fall_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e216d176-d7ec-4be7-874d-3e17bc88c0c3/63357632746.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe91881d-24c8-46e4-9828-563ce607d543/how_to_get_unlimited_gems_in_clash_royale_2020.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d9d7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD9D7 | 5068 bytes |
SHA-256: 9c95bb6dcecb417137c17b652c4e1f46ee61aebdefefbd91e8253d58dd6aa7dc |
|||
font_01_sfnt_off0000eafa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAFA | 10180 bytes |
SHA-256: 0210b8a36c1ac6c2b4020a799f0fff1d37317bb4f585d3c9e6c9f57d3ce8b426 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.