MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous external URIs, with at least one, 'https://pelibifir.ru/aws?utm_term=loreal+frost+and+design+mixing+instructions', appearing to be a link farm designed to redirect users to potentially harmful content. The document body, though heavily corrupted, suggests a lure related to product instructions, aligning with phishing or malware distribution tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/aws?utm_term=loreal+frost+and+design+mixing+instructions PDF link annotation
- http://rozogididibusar.sportsontheweb.net/xipunabote.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491414/normal_601486011b388.pdfIn PDF document text
- https://rovibabewovel.weebly.com/uploads/1/3/4/8/134884015/jonubafopupapilub.pdfIn PDF document text
- http://aydym.club/5772875279743ts8.pdfIn PDF document text
- http://rivilidopu.medianewsonline.com/tigudoxegaze.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4501794/normal_5fff7f6e2b6dc.pdfIn PDF document text
- https://tevadurut.weebly.com/uploads/1/3/2/6/132682826/637092ad56cdc5.pdfIn PDF document text
- https://lepuxodotedob.weebly.com/uploads/1/3/4/5/134507089/a1cb4d752.pdfIn PDF document text
- http://oneshops.space/krav_maga_drillsjqmk2.pdfIn PDF document text
- http://suzamajotibe.mywebcommunity.org/80711677767.pdfIn PDF document text
- http://bestrongbyg.com/9061777661940nr2.pdfIn PDF document text
- https://pixavegabub.weebly.com/uploads/1/3/5/3/135307945/7176513.pdfIn PDF document text
- http://matteset-spon.space/lojisogasenupifawusutidikq3mp.pdfIn PDF document text
- http://bestunew.xyz/97522808302dr049.pdfIn PDF document text
- https://bogezemobazuv.weebly.com/uploads/1/3/1/8/131856224/vufix-mesanugidoje-juvuwow.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479917/normal_5ffa2cd92854c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448727/normal_602cf4d5ad1c7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://e86c6366-0652-46cb-9e1f-5633a133dba9.filesusr.com/ugd/510a18_7d35fe22c9a74a1bbd2167bbc3444cf3.pdf?index=trueIn PDF document text
- https://3465328d-eb21-4af5-a94e-b8fdacefaafa.filesusr.com/ugd/c63bf9_637e12f29eb4400c81ebd8caefcd4960.pdf?index=trueIn PDF document text
- http://wegamaluperetuj.atwebpages.com/nazowoduperalatalibotu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/255189ff-a57e-4719-8d2f-f68a22a59044/wanijogulexomolusunin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2a9a5b5d-7710-41ec-b4b4-6eaa3d60b911/research_methods_for_the_behavioral_sciences_3nd_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97b14692-e13d-4df3-ab36-321897fe4874/65997428162.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/498a54a1-3216-4f12-af8d-983fcba8c9df/71145068565.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a46006d3-f5eb-46db-8116-31de2ea61bcc/vidow.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d45c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD45C | 5352 bytes |
SHA-256: 8d4d7cdabf192febe75ec44995bfdfa0faa554d32902ca2d8fd8131488f6a303 |
|||
font_01_sfnt_off0000e681.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE681 | 10560 bytes |
SHA-256: 98a309ca2d62074046a993de8141e18158a0ac13e446893ade0d6de805c999f5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.