MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
T1059.007 JavaScript
This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The document body, though truncated and obfuscated, contains text related to converting PDF files, suggesting a lure. The heuristic 'SE_ENABLE_LURE' indicates the document likely instructs the user to enable macros or editing, a common tactic for malware droppers. The presence of embedded URLs, particularly 'https://botokaw.ru/award?keyword=convert+pdf+file+to+word+2020+online+free', further supports the phishing and payload delivery intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=convert+pdf+file+to+word+2020+online+free PDF link annotation
- https://cdn-cms.f-static.net/uploads/4414341/normal_60274ff41a42a.pdfIn PDF document text
- http://sevibifodome.getenjoyment.net/sistema_circulatorio_libro.pdfIn PDF document text
- http://wutanumijejol.sportsontheweb.net/bobupetigon.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449406/normal_6043bfd4bc53b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382952/normal_5fc661ba092dc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489993/normal_5ff3c0ecab009.pdfIn PDF document text
- http://gunenekaroz.mypressonline.com/13665695700.pdfIn PDF document text
- http://zukirudon.mypressonline.com/30182694707.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393019/normal_6024b54ab92d0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485318/normal_605b9de7621b8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382782/normal_600968568ef1b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374685/normal_6011629e67943.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480399/normal_603f62d854ce5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484364/normal_603424db4f300.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444647/normal_600a5f5ac3ad8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://kofepiropi.onlinewebshop.net/kolafezufegazugexow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d301f65f-a48a-4aef-9050-a0f681fada49/38018371598.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b366309-58be-4ecc-8c1a-ee4e4481a93d/tunivilabasowuvab.pdfIn PDF document text
- http://mifojizu.myartsonline.com/gaxagapubafazadidenuvenab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d750595a-2664-40a5-962c-7ca211cf1ca3/how_to_be_a_good_public_relations_officer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/463902a9-d578-4ca3-b73e-db8d9506c18e/oracle_19c_virtual_account.pdfIn PDF document text
- http://xedawobu.atwebpages.com/rikotelurulanemojepowoluk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cab08c69-dbb3-4f90-9495-d41fda12ceb7/jufofinegusipale.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f0c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0C1 | 4980 bytes |
SHA-256: 9f5e073906fa841e553084de4a7a236a0aa188f0a562556a5411ecab8ccdafc7 |
|||
font_01_sfnt_off000101dc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101DC | 10884 bytes |
SHA-256: a35618f0a9c766d9e08c6161219276004af87493cc4efe8d9de0327f7c0f29ca |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.