MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF that contains a high-confidence heuristic firing for a phishing lure, specifically an image linking to an SEO redirector. The embedded URL `https://resalured.ru/award?keyword=the+borderline+personality+disorder+workbook+pdf` is the primary indicator of this phishing attempt. ClamAV also detected this file as `Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0`, further supporting the malicious classification. No scripts were extracted, but the PDF structure itself facilitates the redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/award?keyword=the+borderline+personality+disorder+workbook+pdf PDF link annotation
- https://liletalezawo.weebly.com/uploads/1/3/4/5/134591830/gojivoxasuv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384468/normal_602ef9ab87559.pdfIn PDF document text
- https://cdn.sqhk.co/talokelom/iczeQjh/angry_fighting_attack_mod_apk_android_1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448719/normal_600398ce6091e.pdfIn PDF document text
- https://cdn.sqhk.co/tizesefetus/cu7XpH5/football_field_size.pdfIn PDF document text
- https://fudidokogi.weebly.com/uploads/1/3/4/6/134603759/3158914.pdfIn PDF document text
- https://migofaxukov.weebly.com/uploads/1/3/5/3/135394112/510aaa9cd9321.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426819/normal_6046eb85ae208.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484612/normal_6050cc8f0fa6a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4384482/normal_600344e7aa142.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/jezobasit/82500993698.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f9088a21-c5de-474d-bcbe-dbdb542d242c/51379193292.pdfIn PDF document text
- https://s3.amazonaws.com/nafamaragisek/anime_tube_unlimited_ios.pdfIn PDF document text
- https://s3.amazonaws.com/lezerawe/18840227918.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6b64412-aec1-4876-b425-1373053f4ded/fallout_4_companion_perks_ranked.pdfIn PDF document text
- https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_b01a8614e129433283cbb11a6abcc0a8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1c30cfbe-dd58-4cc7-a7ea-9f1e3eae7ba7/81698879901.pdfIn PDF document text
- https://s3.amazonaws.com/waxegatulo/jojugaropakepovise.pdfIn PDF document text
- https://a49aa754-465e-4bbd-924e-b3d0e7b66bd4.filesusr.com/ugd/81d6a4_a017726e222f43b298a188cb76c8bf99.pdf?index=trueIn PDF document text
- https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_a78880127ad443c3b412a607d8bc9541.pdf?index=trueIn PDF document text
- https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_cd2b840c28ba4fc3b72de3c2129989d3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e3345149-963d-4370-a4b6-ddad38ccd06e/hound_of_the_baskervilles_1959_full_movie.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fd4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD4B | 5264 bytes |
SHA-256: b6eb09447310d06a27d3e5abc6de11a2fa9150a0a9ff274266bef0c8dc4a647d |
|||
font_01_sfnt_off00010f29.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F29 | 11152 bytes |
SHA-256: 3d6512663c79261abeaa3f1123381637d25e70080377ec16edcef389adf433b7 |
|||
font_02_sfnt_off000134ff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x134FF | 4324 bytes |
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.