MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was identified as malicious by ML classifiers and ClamAV, flagging it as a phishing trojan. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to redirect users to malicious content. The primary URL, https://pelibifir.ru/strik, is likely part of this redirection chain.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=best+upgrades+for+tippmann+98+custom PDF link annotation
- https://cdn.sqhk.co/fawabanof/jbjbou2/hand_drill_guide_kit.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479214/normal_5ff8c7439a869.pdfIn PDF document text
- http://lexamopelezun.mywebcommunity.org/cardiac_conduction_system_pathway.pdfIn PDF document text
- https://cdn.sqhk.co/ripigopes/PyjdL15/download_game_bomb_squad_mod_android_1.pdfIn PDF document text
- http://roxelejabojafe.scienceontheweb.net/architecting_microsoft_azure_solutions_study_lab_guide.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4530846/normal_5ff25c5d92a11.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://nakeviw.myartsonline.com/woruzotomebode.pdfIn PDF document text
- https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_9f1b07f7748c47adbaee4e0479e26afe.pdf?index=trueIn PDF document text
- https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_bcca525d000e4d728423993f40a92060.pdf?index=trueIn PDF document text
- https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_5df0742c5472424aa97f496c5bb38931.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bc2dc0a6-587f-450d-8b21-16d2372fcaef/shark_lightweight_iron_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10ce2584-ffc3-4509-8fb6-7f05c761b381/dell_e6410_driver_download_windows_7.pdfIn PDF document text
- https://6e229dea-1f83-4be8-8cd3-388eabd4f5e3.filesusr.com/ugd/1cfe37_03053806a16b4a23844d1297c0e2d46e.pdf?index=trueIn PDF document text
- https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_0bfc56e223a34bf6856b7487e6d88882.pdf?index=trueIn PDF document text
- https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_198eb4c4316b4fd49639fa5049f9dca7.pdf?index=trueIn PDF document text
- https://22fea36a-5e19-4af1-b4aa-fe6e1efe0ee9.filesusr.com/ugd/b5a188_99b911bbd9634f7a916a2a225c33d1a2.pdf?index=trueIn PDF document text
- https://2065f6f1-29fb-48ac-a230-4f4ab2d4b746.filesusr.com/ugd/b62953_413477d757584830be539bdbf7ad0f2d.pdf?index=trueIn PDF document text
- https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_670bfa99ef0740e2abf1dc67bb58ae27.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fcab0cc0-a94d-476d-b953-95114827d3fc/which_is_the_best_smartwatch_brand_in_india.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f4b6b6c-48f0-4022-84a0-8204427ab7ea/95874642384.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed97.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED97 | 5840 bytes |
SHA-256: 020c8f65baeb0f6d2d3434e4df4906ea84bcca5042ea48f492ec243ea8c165f7 |
|||
font_01_sfnt_off00010167.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10167 | 11540 bytes |
SHA-256: 7df3b4226826bd7b08777e4c18eefb6471cbc2250d37e5dd629659ee6623c27c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.