MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm designed to improve SEO for malicious content. The primary URL, https://midufefew.ru/strik?utm_term=visual+studio+2015+professional+download+free+full+version, suggests a lure related to software downloads. While no scripts were explicitly extracted, the PDF structure and extensive link farm indicate it's designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9954
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=visual+studio+2015+professional+download+free+full+version PDF link annotation
- https://cdn.sqhk.co/vibisidumes/id6jejf/poriw.pdfIn PDF document text
- https://vijekufimukij.weebly.com/uploads/1/3/0/9/130969895/xibur_bogidibirad_rumaxad.pdfIn PDF document text
- https://pufoxedoj.weebly.com/uploads/1/3/4/4/134438994/7575789.pdfIn PDF document text
- https://zozopagutuduxiz.weebly.com/uploads/1/3/4/6/134669393/4589771.pdfIn PDF document text
- https://cdn.sqhk.co/koxajavu/zhc21jg/80900711314.pdfIn PDF document text
- https://figapizezedop.weebly.com/uploads/1/3/4/3/134364787/3894649.pdfIn PDF document text
- https://radojevujexoki.weebly.com/uploads/1/3/1/8/131871685/9587746.pdfIn PDF document text
- https://cdn.sqhk.co/sexifirume/dojfAgd/16790166866.pdfIn PDF document text
- https://cdn.sqhk.co/rasirise/hgfjaMz/pewedawikivexumegok.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/teximikamukubo/giwapijovodenis.pdfIn PDF document text
- https://s3.amazonaws.com/kujesulad/20675283009.pdfIn PDF document text
- https://s3.amazonaws.com/sepovutapakogaf/vovilavabogijudunegun.pdfIn PDF document text
- https://s3.amazonaws.com/fotojipifuzitul/nutrition_information_popcorn_oil_popped.pdfIn PDF document text
- https://s3.amazonaws.com/dewazewokib/enron_the_smartest_guys_in_the_room_netflix_uk.pdfIn PDF document text
- https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_d289664a51354425b39a5b472e9df738.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f163f05a-5e31-4dfd-8d9d-4e63eb1fd4f0/tl-wr841n_router_specifications.pdfIn PDF document text
- https://52ed6390-a5c1-4502-9f93-599cf6d98ad1.filesusr.com/ugd/f7fbc8_a4b80b1e48ca4ee19c357a841f966f26.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gowupuzokowuxes/american_airlines_ticket_number_format.pdfIn PDF document text
- https://s3.amazonaws.com/tosego/best_bookshelf_speakers_for_home_theater.pdfIn PDF document text
- https://s3.amazonaws.com/xomudufe/fezuxuf.pdfIn PDF document text
- https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_4016ea54245248648bc004dd646dcd58.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3ab4bcae-9ba3-4e85-bb83-a7d9a9bc873a/what_equipment_do_i_need_for_crossfit.pdfIn PDF document text
- https://24451074-f53b-4065-993c-779ba3957988.filesusr.com/ugd/0ae25f_a58d4edc08fc416aab6e9d138c7df56d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bulikowexunepov/linkers_and_loaders_ppt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/88731e98-efab-4e98-803d-8d9d1b00db20/gixozefitoduxowivoz.pdfIn PDF document text
- https://s3.amazonaws.com/sukobogixe/osha_10_electrocution_hazards_assessment_answers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3df.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3DF | 5684 bytes |
SHA-256: c513d0348616ec4b09e3a934485f461f39dfeb84c8cdd714488db0a27eb1dce8 |
|||
font_01_sfnt_off000107b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107B9 | 5600 bytes |
SHA-256: 2899ae383b5be9b2e11158d339a3b90c9014025a7c3d84ddca4ce53a916b1171 |
|||
font_02_sfnt_off00011afc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AFC | 11896 bytes |
SHA-256: 8e0eebf2d59cfc22535f2e0486aa8c6af8b8d8dcf35c5bd64a16bb0048b368d4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.