MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file contains numerous external links, a common technique for SEO poisoning and phishing. The primary malicious URL, https://vilenefex.ru/wix?keyword=chemfax+lab+answers+chemical+reactions, is presented as a search result, likely to trick users into visiting a malicious site. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as Pdf.Phishing.Trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/wix?keyword=chemfax+lab+answers+chemical+reactions
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/feseni/glyceryl_trinitrate_infusion_guidelines.pdf
- https://uploads.strikinglycdn.com/files/8bfb5976-804a-4f08-b278-31d4a505a07d/farewell_my_lovely_film_plot.pdf
- https://s3.amazonaws.com/nalifij/role_of_caste_in_politics.pdf
- https://s3.amazonaws.com/nafoxuda/game_designer_job_description_template.pdf
- https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_5024fca5b8c24343844d9225ad07b90b.pdf?index=true
- https://uploads.strikinglycdn.com/files/29223a8d-6a46-433d-aae7-9facc2ade2eb/lujebedugenonakujukapu.pdf
- https://uploads.strikinglycdn.com/files/da3718ec-fbeb-43ae-b0d3-81c6f8e60fe2/72874242206.pdf
- https://85fc0914-20e3-4f1c-be8c-de7e6f89f47e.filesusr.com/ugd/a44510_55d71e005f714d1fae5518097c19c2f7.pdf?index=true
- https://uploads.strikinglycdn.com/files/b84b17bb-6682-4987-b40a-3dc2a0651599/god_emperor_of_dune_miniseries.pdf
- https://uploads.strikinglycdn.com/files/34734774-fee1-4e65-b38e-5fe0f94d97d3/bedojalatuzupat.pdf
- https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_6e0394ee32b545b583e837e6bc8704d1.pdf?index=true
- https://uploads.strikinglycdn.com/files/a5edeb8d-3389-4549-a6e3-24fbf46eefbb/an_inspector_calls_cast_2012.pdf
- https://uploads.strikinglycdn.com/files/791adf68-815b-4741-bf31-3f53fa530852/english_phonetics_and_phonology_peter_roach.pdf
- https://s3.amazonaws.com/limepusotanal/sub_zero_650_service_manual.pdf
- https://uploads.strikinglycdn.com/files/71472a75-a980-420c-841c-3979df4af3dc/hp_elitebook_8540p_driver_pack.pdf
- https://uploads.strikinglycdn.com/files/f3d9a568-4b41-4f2e-8f54-3391058975f3/the_slight_edge_chapter_4_summary.pdf
- https://uploads.strikinglycdn.com/files/5b7cfdf1-8575-4a38-8c81-3ab462a60ba1/tulimanofadikulofif.pdf
- https://s3.amazonaws.com/gewuwasi/pitagebid.pdf
- https://uploads.strikinglycdn.com/files/8799514a-5a5d-4ed9-9326-d0f2221ab479/poor_mans_james_bond_vol_5.pdf
- https://s3.amazonaws.com/dinigugaxej/laxokikubakiwalanivoxa.pdf
- https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_857469896b6e47818233f12fe6f3738e.pdf?index=true
- https://s3.amazonaws.com/fonibinaraj/basic_aptitude_test_sample_questions_and_answers.pdf
- https://uploads.strikinglycdn.com/files/0c46f7e6-7231-44ad-8cbc-cb7f23105a9a/5804926734.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ecd9.binf6fde39bb0a5098664dbaac39a01c58c1896345f5eb0d0311c4d0a0b730b1763 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xECD9 | 5328 bytes |
font_01_sfnt_off0000fedc.bin8c575f31329ad7431e8a320818f64c57b0d76f36cd997114cdb01359dc334599 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEDC | 10628 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.