MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many of which are part of a link farm designed to improve search engine rankings. One prominent URL, 'https://huntic.ru/pbw?utm_term=download+film+no+thank+you+2014+sub+indo', suggests a lure for downloading content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://huntic.ru/pbw?utm_term=download+film+no+thank+you+2014+sub+indo
- https://cdn-cms.f-static.net/uploads/4374369/normal_606e474c126d9.pdf
- https://fozivumi.weebly.com/uploads/1/3/4/7/134761275/tonezix-bojeponuwovutow.pdf
- https://cdn-cms.f-static.net/uploads/4412588/normal_602b9632eade3.pdf
- https://zagozejidenadap.weebly.com/uploads/1/3/1/4/131407028/5106824.pdf
- https://magojumenuta.weebly.com/uploads/1/3/4/3/134361537/8744318.pdf
- https://cdn-cms.f-static.net/uploads/4413469/normal_6026dc547b8eb.pdf
- https://visumosibe.weebly.com/uploads/1/3/0/8/130814065/8560517.pdf
- https://xipurewaxo.weebly.com/uploads/1/3/4/7/134759043/bazon_vegosi_vatopavuwepo.pdf
- https://cdn-cms.f-static.net/uploads/4454436/normal_600e417b96de8.pdf
- https://karopudalel.weebly.com/uploads/1/3/4/8/134881347/gaxitagaxoni_zipawuda.pdf
- https://cdn-cms.f-static.net/uploads/4378379/normal_60580fa1dc135.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/3594b2d4-06e7-4550-ac16-0d81fccd0490/portfolio_solar_lights_lowes.pdf
- https://uploads.strikinglycdn.com/files/34e04560-f859-459c-bec0-de2d29d22980/87948547900.pdf
- https://uploads.strikinglycdn.com/files/df85ea19-e5fa-41ca-b586-644100cf8c28/ansys_workbench_tutorial.pdf
- https://uploads.strikinglycdn.com/files/4e8e74da-49f8-4ffe-b664-0354fce1b55d/what_are_the_principles_of_design.pdf
- https://uploads.strikinglycdn.com/files/cb94e06b-e5c0-408a-8696-cdf4fcc33374/jinejataxukiraxomoluwumub.pdf
- https://uploads.strikinglycdn.com/files/5226b7fb-49d2-4f79-9da7-7cde6568dc1f/pitozagujugiwunisuw.pdf
- https://uploads.strikinglycdn.com/files/32267248-c124-489f-abd9-9286307ae672/eddie_bauer_newport_bassinet_assembly_instructions.pdf
- https://uploads.strikinglycdn.com/files/fe93818c-61d5-4593-9801-a5970e0e5566/walther_pk380_pink_reviews.pdf
- https://uploads.strikinglycdn.com/files/020f1906-7a98-4567-b4b3-43629b588bc0/whirlpool_refrigerator_models_with_price_list.pdf
- https://uploads.strikinglycdn.com/files/fabe765e-db89-442c-b074-9596fad8c287/devoir_interactions_fondamentales_1ere_s.pdf
- https://uploads.strikinglycdn.com/files/26c5dd72-571e-402a-8d4b-86f5dd5c7c69/adverbial_clauses_exercises_for_class_8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f582.bin95f90087df69f67d755da724e70b705f55f7e09a4cc1bb45599fffbb5798e417 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF582 | 4288 bytes |
font_01_sfnt_off000104b5.binf94a2ed83440f0db1a885b518315d986c9c1b65707efbcd284983983bce05fab |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104B5 | 5860 bytes |
font_02_sfnt_off000118ac.bin359ebbf5ae716010125754c42236935e7c9a033af16f3d3646bd7fafd2107d39 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x118AC | 11084 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.