MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with at least two pointing to disposable hosting domains, suggesting a link farm or redirection scheme to deliver malicious content. The document body, though heavily obfuscated, appears to be a lure related to a legal document, likely intended to trick users into clicking the embedded links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=convenio+de+ginebra+1929+pdf PDF link annotation
- http://nanonewe.scienceontheweb.net/ximatanufe.pdfIn PDF document text
- http://zimezobot.getenjoyment.net/zawexofarukofuwibovewod.pdfIn PDF document text
- https://cdn.sqhk.co/jisepozidis/1iexugi/73325474962.pdfIn PDF document text
- http://nuvuxek.iblogger.org/93237402780.pdfIn PDF document text
- https://nadenekaf.weebly.com/uploads/1/3/0/7/130739264/9283623.pdfIn PDF document text
- https://nopovufarake.weebly.com/uploads/1/3/1/3/131379277/noguzorowadirojozuno.pdfIn PDF document text
- http://vumajufeboxidik.mywebcommunity.org/rimogetogugodufevosi.pdfIn PDF document text
- https://cdn.sqhk.co/muzolorakow/iehdPJU/mowinime.pdfIn PDF document text
- https://cdn.sqhk.co/bulixanejad/mQjcCjg/ifttt_alexa_alarm.pdfIn PDF document text
- https://cdn.sqhk.co/jufebarur/AOgf1ia/40144866920.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_521e828f876e43d1b62a5ebaf4350725.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e3ff5f81-11f5-476e-9a50-4a1165d36a13/30481967930.pdfIn PDF document text
- http://jajepurexax.rf.gd/how_to_remove_baby_einstein_jumper_seat.pdfIn PDF document text
- https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_787c52cafdab4f8bb99731f3fb08b474.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6368d041-e5d3-42ec-8a7e-719e7ac62aff/how_to_undo_a_ratchet_belt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58475ab8-086e-4989-a189-7ee355868a7d/what_is_the_name_of_the_plant_on_little_shop_of_horrors.pdfIn PDF document text
- http://luxupovokajaf.onlinewebshop.net/line_graph_worksheets_grade_8.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9658a364-9532-4b3b-a4f5-5fb8401d46c6/towatifugazosuma.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d75bc839-36a5-4527-b7bf-65d4af221c55/hadoop_for_dummies_by_dirk_deroos.pdfIn PDF document text
- http://sogoxutagejuno.atwebpages.com/71962830908.pdfIn PDF document text
- https://c4bedd8b-a3e9-4aa8-9751-a6fde4035b7e.filesusr.com/ugd/037f08_74b464415dc644b981424741d98bd3b0.pdf?index=trueIn PDF document text
- https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_e1ed1150d082440e903c10900026541b.pdf?index=trueIn PDF document text
- http://fepapasofefo.epizy.com/74086922473.pdfIn PDF document text
- https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_ed71268ad09a4d12b215f717acb08c49.pdf?index=trueIn PDF document text
- http://buwozefavimim.epizy.com/33253628664.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010670.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10670 | 5444 bytes |
SHA-256: c96e581cfa568ca807d88b53cd27726a03a46a84a5bfd2579ce77f20dd81a93e |
|||
font_01_sfnt_off0001190a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1190A | 11172 bytes |
SHA-256: 2f3ad9edb828d7b2d3ff15fe6ebd5c49a596046c4d908ee8996277567772ceae |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.