MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with a high concentration on disposable hosting, and a specific heuristic flagging it as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing or a trojan. The primary malicious URL identified is https://pelibifir.ru/strik?utm_term=writing+down+the+bones+prompts, which is likely used to redirect the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=writing+down+the+bones+prompts PDF link annotation
- http://moxegelubopidi.sportsontheweb.net/statement_of_accounting_standard_14.pdfIn PDF document text
- http://tijudozi.scienceontheweb.net/10500629885.pdfIn PDF document text
- http://heleogose.online/how_do_you_cite_a_quote_from_a_famous_person_in_apavuaqp.pdfIn PDF document text
- http://zixaxagewan.mypressonline.com/30613770102.pdfIn PDF document text
- http://profapp.pro/95659726981pnqbu.pdfIn PDF document text
- http://alcexpress1.xyz/taylormade_r15_driver_specs4v7ew.pdfIn PDF document text
- http://tibijosetinaj.getenjoyment.net/oligopoly_market_structure.pdfIn PDF document text
- http://goldenframecollision.com/huskee_lawn_mower_lift_partsjiyac.pdfIn PDF document text
- http://mifirejetevina.getenjoyment.net/kejopojozutinofizutapid.pdfIn PDF document text
- http://gopadaxin.mywebcommunity.org/57722560403.pdfIn PDF document text
- http://vilopeg.xyz/what_does_bonnies_mom_say5ffpj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://f79c4d19-9b07-4ca9-ba82-4f938217db57.filesusr.com/ugd/c0d3e8_46cec4a1352544ea96c3f158911d1e65.pdf?index=trueIn PDF document text
- https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_efa18c333188450a87bc19bef9f7bc76.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1156c8ff-ce1a-48a9-a035-859186b6f0c0/61550271083.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5dbc05ac-3ab6-4edf-93a6-0f469f953bea/61939116837.pdfIn PDF document text
- http://zuvuzevo.atwebpages.com/samalem.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a3f2fe21-03c6-4462-8259-03fcaf461696/how_to_fold_up_a_bowflex_power_pro.pdfIn PDF document text
- http://sasukagisodubex.onlinewebshop.net/65226320505.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7450ef85-d5db-4a49-8445-a9b7f2d45936/verb_tenses_explanation_and_exercises.pdfIn PDF document text
- http://sopavame.onlinewebshop.net/titekop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ea7f1c16-8459-47b1-b1d0-2a7d2c72496a/26962121006.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b1c61e08-c5f0-4095-8a0b-898831669437/57276500448.pdfIn PDF document text
- https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_bffd3452668645c2b58a22e0fe26f386.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/de90ddff-d7f8-4fed-a3cb-8560bee25bcf/what_are_the_6_ps_of_marketing.pdfIn PDF document text
- http://bujijawuta.atwebpages.com/the_hobbit_3_tamil_dubbed_movie_free_download_tamilrockers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f018.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF018 | 5376 bytes |
SHA-256: f00f6b36e5ae35108b88865c59c238b291184c332ae9d01eef98888d2188ec66 |
|||
font_01_sfnt_off0001024e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1024E | 11280 bytes |
SHA-256: d617d70a49a2228a95d1f9ad20bb1075516da29c4349015c7173da65d0edc4bf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.