MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document is identified as a phishing lure due to its image-only nature and embedded malicious redirector link. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates that the link 'https://crophysi.ru/award?keyword=bomb+calorimeter+manual+pdf' points to known malicious infrastructure. The document's structure and the presence of multiple links suggest an attempt to lead the user to a compromised site, likely for credential harvesting or further malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.6440
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 38 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/award?keyword=bomb+calorimeter+manual+pdf In PDF document text
- https://static.s123-cdn-static.com/uploads/4377371/normal_60072c33795a9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4452595/normal_6044fd2fc1513.pdfIn PDF document text
- https://cdn.sqhk.co/xolizoxime/4I3hegi/among_us_imposter_keyboard_controls.pdfIn PDF document text
- https://s3.amazonaws.com/fotepopunaj/selective_services_registration_form.pdfIn PDF document text
- http://dajexori.mypressonline.com/how_to_use_bosch_pocket_scan_obd_1000.pdfIn PDF document text
- https://cdn.sqhk.co/gawisibiw/ia1Dih5/jikiwopapubanivabupotavo.pdfIn PDF document text
- https://s3.amazonaws.com/niporofez/vizoru.pIn PDF document text
- https://34fef40c-4934-4c56-b24d-59915ed92566.filesusr.com/ugd/806295_8c89b1d4dbc742f99b9626da1ac86a73.pdf?index=trueIn PDF document text
- https://033a7475-7ccb-45c1-8f1e-38fd320d48d0.filesusr.com/ugd/03a576_340fc21711874dc7aca9afc6718be9e2.pdf?index=trueIn PDF document text
- https://bf68d742-fb98-404a-ab47-1dcf24f7df52.filesusr.com/ugd/83e7fd_abe451cbab88411dad876e957a30d6bf.pdf?index=trueIn PDF document text
- https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_c6b3a15639004fe0a89a97d9a4ea901d.pdf?index=trueIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.