MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains numerous external links, with a primary redirector identified as 'https://nipisod.ru/strik?utm_term=how+to+use+ge+stackable+washer'. This URL is associated with a phishing lure, disguised as information about a GE stackable washer. The presence of a link farm and the ML classifier's high confidence score further support a malicious intent, likely to lead users to a phishing site or download further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=how+to+use+ge+stackable+washer PDF link annotation
- http://tokudujadi.medianewsonline.com/19080953828.pdfIn PDF document text
- http://kesogapebenem.iblogger.org/ejercicios_con_numeros_romanos.pdfIn PDF document text
- http://zazorin.scienceontheweb.net/45101538869.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://a49ec80b-b4e3-4dac-84ed-d687b6aff6a5.filesusr.com/ugd/46d696_4d6c88352de2427c83e9f3984f42d868.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xirixepo/2362695101.pdfIn PDF document text
- https://s3.amazonaws.com/leributafa/how_to_grow_cabbage_in_zimbabwe.pdfIn PDF document text
- https://s3.amazonaws.com/kukupunopedon/texas_republic_flags.pdfIn PDF document text
- https://2a403a33-5f6e-4534-96f9-742aa7325afc.filesusr.com/ugd/d2da83_4bd2dba7ba544af1aa58f47b29476277.pdf?index=trueIn PDF document text
- https://065b66ee-25d8-4381-b309-094abc4d823c.filesusr.com/ugd/2703e6_82418c41ef414255a6dc7cdab91269cc.pdf?index=trueIn PDF document text
- https://9c8f49e5-5895-4656-bc53-c560b1a0ede3.filesusr.com/ugd/0f7a6f_b5facaeaae0f4722b1050e66627ff5c3.pdf?index=trueIn PDF document text
- http://radoneg.rf.gd/como_converter_arquivo_para_autocad.pdfIn PDF document text
- https://s3.amazonaws.com/varoximu/chamberlain_liftmaster_professional_1_2_hp_troubleshooting_light.pdfIn PDF document text
- https://s3.amazonaws.com/rezugekolaba/wetedisovanuv.pdfIn PDF document text
- http://fozijasorizol.epizy.com/82013899908.pdfIn PDF document text
- https://43cb2d18-1589-43a7-b1c5-fe1278e1c76d.filesusr.com/ugd/370b54_8aa91a4841394c42b55ae9160b48b14f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kiguteperilodu/jlab_epic_air_wireless_earbuds_review.pdfIn PDF document text
- https://5e73d190-47a4-4ead-99bf-7e9069f06a16.filesusr.com/ugd/55cc32_523a4ff4cba84f93ab6f45b129c6f7f4.pdf?index=trueIn PDF document text
- http://zekarevuwo.epizy.com/zupetikopuwamite.pdfIn PDF document text
- https://e33362eb-94ba-4427-a888-6f4863169a18.filesusr.com/ugd/36ce96_1b860ca8d45d49c3a2298f269b4eb743.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e892.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE892 | 5320 bytes |
SHA-256: c63e53e0e0398940bae9f9c9fb3311405fd8b1a73636885c603ee5b1f251c4b1 |
|||
font_01_sfnt_off0000fab5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAB5 | 10984 bytes |
SHA-256: 96636b359023f045fcbafe36fbf666b3d257d1f66d896ee0b3f067947b5d348c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.