MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF was flagged by multiple heuristics as malicious, including a critical alert for linking to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs. The numerous embedded URLs, many pointing to disposable domains or link farms, strongly indicate a phishing or redirection attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/123?utm_term=hazy+maze+cave+septic In PDF document text
- https://cdn-cms.f-static.net/uploads/4428039/normal_5fdb603b32deb.pdfIn PDF document text
- https://mamufitixiru.weebly.com/uploads/1/3/4/6/134640278/wupelesorodata_kidevosumefive.pdfIn PDF document text
- http://digitalliteracyinstitute.com/dugoja8dms6.pdfIn PDF document text
- http://noverst.xyz/metric_system_worksheet_chemistrykn8a1.pdfIn PDF document text
- https://cdn.sqhk.co/zefadanexa/jcOghlz/piano_lessons_for_beginners_free_online_youtube.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490369/normal_6016234ab7747.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4502493/normal_5ffae64c02313.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426416/normal_5fe8b80a1eb2d.pdfIn PDF document text
- http://ccckkkkk.space/29285776508o8wt9.pdfIn PDF document text
- https://cdn.sqhk.co/suxumeva/LJgMfgg/vrse_batman_how_to_play.pdfIn PDF document text
- https://bamukafigozoxin.weebly.com/uploads/1/3/4/8/134861202/191f84c804531e.pdfIn PDF document text
- http://verifiedbadge-lnstagram.com/max_speed_road_warrior_race_3d_modelzvkmz.pdfIn PDF document text
- https://fajuvupo.weebly.com/uploads/1/3/5/3/135310445/ruzug_jebob_fijepox_jivow.pdfIn PDF document text
- https://vokinojen.weebly.com/uploads/1/3/4/8/134851280/eb9f65367031d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4412159/normal_5ff170536b693.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4473415/normal_5fcdbb37c234f.pdfIn PDF document text
- https://cdn.sqhk.co/vibefoparo/gdEigcB/bulenijevilorepobap.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4392463/normal_5fee8cf9e9e28.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4499984/normal_6018db1572542.pdfIn PDF document text
- https://cdn.sqhk.co/bagudivibi/icjgOMH/65302070173.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/jumedemimo/china_visa_form_for_indian_nationals.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ce9d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCE9D | 4752 bytes |
SHA-256: 67444d49aa5e953042b7cbe278c8ccab94f3a6f4c67ad68c3d04de116d12254a |
|||
font_01_sfnt_off0000df79.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDF79 | 4696 bytes |
SHA-256: e4fe70d252e8935876da3278a5a70562d59d91a55c1aac686be1857da2b72945 |
|||
font_02_sfnt_off0000ef84.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF84 | 10472 bytes |
SHA-256: ffe3133fa4180c7f217e46ba7de7c68476246731b696e91959f3bf28da9f81df |
|||
font_03_sfnt_off0001133b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1133B | 4324 bytes |
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.