MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded and repeated invisible links designed to direct users to external URLs. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' specifically calls out the use of these links to deliver a payload via the URL https://leonvi.ru/strik?utm_term=shiginima+minecraft+cracked+launcher+v4+400+teamshiginima.com. The 'PDF_SEO_LINK_FARM' heuristic further indicates a large number of external links, suggesting an attempt to manipulate search engine results or distribute content widely. The ML classifier and ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=shiginima+minecraft+cracked+launcher+v4+400+teamshiginima.com In PDF document text
- https://static.s123-cdn-static.com/uploads/4371248/normal_5ffc8f73017d2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389352/normal_60380e4e8f8d5.pdfIn PDF document text
- https://lemabifi.weebly.com/uploads/1/3/4/3/134319461/pujunik.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4452171/normal_5ff5282d22e5d.pdfIn PDF document text
- https://xopaluwejur.weebly.com/uploads/1/3/1/8/131857284/bf7df39.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4496616/normal_6063de70d67c3.pdfIn PDF document text
- https://mobuverafawez.weebly.com/uploads/1/3/5/3/135346795/dapisev-vifaligi-potudodin-kibewor.pdfIn PDF document text
- https://zajanitemamivow.weebly.com/uploads/1/3/2/3/132303208/xodujerumukefisukaf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443810/normal_604bae188cbb2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/kezemiradigu/epson_wf_2630_cartucce_ricaricabili.pdfIn PDF document text
- https://s3.amazonaws.com/xufoxorog/art_merit_badge_pamphlet.pdfIn PDF document text
- https://s3.amazonaws.com/wegemebufojafak/dewukuzuvidukeruze.pdfIn PDF document text
- https://s3.amazonaws.com/fuvidokibet/1848448901.pdfIn PDF document text
- https://s3.amazonaws.com/bevekizadoxuj/angry_birds_2_mod_obb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c265fe3-db6d-40ab-9643-fabae8f3604e/kufegazulojulirojaliv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5c281c83-8321-4262-a042-f7977a5e4ebf/pdf_english_for_beginners.pdfIn PDF document text
- https://s3.amazonaws.com/furunumaroxun/90755358351.pdfIn PDF document text
- https://s3.amazonaws.com/salosibejodod/jokaroxuxesemavabenolajit.pdfIn PDF document text
- https://s3.amazonaws.com/bepukuba/samizanotaxon.pdfIn PDF document text
- https://s3.amazonaws.com/zevutebulaworel/ssb_online_form_2018_sarkari_result.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/abfe0264-0083-4710-9a32-bd1b41cb5691/american_megatrends_bios_settings.pdfIn PDF document text
- https://s3.amazonaws.com/zafijukopa/ucf_molecular_cell_biology_prerequisites.pdfIn PDF document text
- https://s3.amazonaws.com/gizonukorad/54513707160.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef19.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF19 | 5924 bytes |
SHA-256: a33454d54141c125dc13897f10cd2ecfb67801f1143ba7d5d05949549486ff6c |
|||
font_01_sfnt_off00010328.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10328 | 12112 bytes |
SHA-256: 30805ac48ceb463a71d22155afc716dc76c7daf1b2e3bec6ffac6ae6a264a303 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.