MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, many hosted on disposable domains, suggesting a link farm or phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing and trojan activity. The embedded URL points to a site that appears to be part of a phishing campaign, disguised with a seemingly innocuous topic.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=how+to+set+up+a+portable+air+conditioning+units PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475737/normal_60562b09b6e8a.pdfIn PDF document text
- http://difozoxezepi.getenjoyment.net/98371548979.pdfIn PDF document text
- http://worelimupuvefam.mywebcommunity.org/what_is_health_psychology_course.pdfIn PDF document text
- https://matazesugol.weebly.com/uploads/1/3/4/7/134702103/wegagajedunab-jofini.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4476288/normal_5fefeeb0b076d.pdfIn PDF document text
- http://nebatomefov.scienceontheweb.net/bistable_multivibrator_datasheet.pdfIn PDF document text
- https://xokebewogaxuwu.weebly.com/uploads/1/3/4/5/134588239/rajiwali.pdfIn PDF document text
- https://xagatozemeladab.weebly.com/uploads/1/3/1/4/131406701/fasoropatelefo.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486765/normal_6008de6b8d067.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4406775/normal_5fcbb14100328.pdfIn PDF document text
- https://senamevab.weebly.com/uploads/1/3/4/6/134689233/nagoxipewafon.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387815/normal_5fdf7ca0962a9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jigezilor/js_bitwise_performance.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/028106c0-6d14-4e3d-a49e-0e61bc6994ba/is_the_maiden_voyage_multiplayer.pdfIn PDF document text
- https://c84ffda1-e72a-45fa-8ce8-a771970cf326.filesusr.com/ugd/9fd656_6623d02cf5e549ecb30b7e3fae287ed9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d7ca4dff-fdee-414b-b7c3-0271a58809e8/add_2nd_edition_ravenloft.pdfIn PDF document text
- https://s3.amazonaws.com/limewub/cpp_industrial_engineering_curriculum_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77080838-8f42-472e-b485-ab4718620bfa/ladanawapirijep.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04780439-a510-4f9d-be15-0cddb7a919d1/diweredowafud.pdfIn PDF document text
- https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_c39857365a714bcdb400fedefd4e37de.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kavalukato/89334526405.pdfIn PDF document text
- https://s3.amazonaws.com/ganubifirigevi/bed_sheets_and_comforter_set_queen.pdfIn PDF document text
- https://s3.amazonaws.com/fumiposamisur/13291260970.pdfIn PDF document text
- https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_67611403f216483f898a2e2f59a5545a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fbbf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBBF | 5436 bytes |
SHA-256: 7c36392834aa0fc6d7232f3ea5feaa262786cb49472279a09309a0004c888e82 |
|||
font_01_sfnt_off00010e4f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E4F | 10852 bytes |
SHA-256: d77017e0a73e03223daa062f0c2049789a2349532833f1e8f5dfcbab8481d5a4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.