MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a critical heuristic identifying a link farm. The primary malicious URL, https://maypoin.ru/strik, is presented in a context that mimics a search result for a popular movie, suggesting a phishing or malware distribution lure. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=what+country+is+maze+runner+death+cure+on+netflix PDF link annotation
- https://jadivamanug.weebly.com/uploads/1/3/4/8/134868371/8385149.pdfIn PDF document text
- https://lomedalepa.weebly.com/uploads/1/3/4/4/134438906/3fff42dac421d1.pdfIn PDF document text
- https://wamogipoko.weebly.com/uploads/1/3/0/7/130739383/5c0238cd2d5af81.pdfIn PDF document text
- https://xadifera.weebly.com/uploads/1/3/1/4/131438156/681943.pdfIn PDF document text
- https://bilugejedegigel.weebly.com/uploads/1/3/4/0/134017605/zufipimumuboxonanan.pdfIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7573d88f-e617-4ab4-aec7-93f501a0e067/67314113804.pdfIn PDF document text
- https://s3.amazonaws.com/gezetega/xobekarelaw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6168558-c8ea-4a81-8e5c-e506066db4df/miniature_dachshund_puppies_for_adoption_in_texas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68d8f0e2-c56d-45ed-b7f9-c5cdaed13729/2014_jeep_grand_cherokee_srt_service_manual.pdfIn PDF document text
- https://s3.amazonaws.com/pipaneku/batman_arkham_origins_apkpure.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c8dbabf-83c5-434f-a1f0-c095634a70bb/elkay_water_fountain_service.pdfIn PDF document text
- https://s3.amazonaws.com/goviwigax/bootstrap_form_input_style.pdfIn PDF document text
- https://s3.amazonaws.com/xebuvuwov/97819453731.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bcb70dea-15a8-4711-8038-ef2eb25ad49b/why_wont_my_computer_recognize_my_mp3_player.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a66b528c-1245-40a7-af80-f0ea6d3d5afa/computer_and_software_repair_near_me.pdfIn PDF document text
- https://s3.amazonaws.com/jaloto/vifuvu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7a267837-31e3-4713-9184-0ee9c58b0f17/69325503146.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d4a5151-87e1-4d8d-9ff2-762a532082f8/35751697473.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4425a92-3358-4c6c-a817-74c05d935251/what_is_the_relationship_between_dual_cooperative_and_fiscal_federalism.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/462acf18-bd33-4a0c-bacb-2cd9214080c4/93070582060.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4dd3ff40-6cc1-4739-98b3-7090c2b74649/do_fathers_take_paternity_leave.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45e8eb10-00b0-4d9e-9387-0a72a706857f/night_feeders_full_movie.pdfIn PDF document text
- https://s3.amazonaws.com/xirixepo/connected_components_in_mapreduce_and_beyond.pdfIn PDF document text
- https://s3.amazonaws.com/fovezewi/6379168994.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off000105ab.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x105AB | 13812 bytes |
SHA-256: 36e54c66a0b5176c4e3d302b5cc46c0849b2dc62dd02e2c45d629d74775f4de7 |
|||
font_00_sfnt_off0000f30e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF30E | 5496 bytes |
SHA-256: 39c6aa23c48c252ca2c930a000738b630fa80864ace58589e282d8e12287bf17 |
|||
font_02_sfnt_off00012c1d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12C1D | 10848 bytes |
SHA-256: 3814b5f3049a7876e8bd6fb165312f8e6a54d43625f56e5fc4a7bc7e4b162d71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.