MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1539 Steal Application Data
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier. The heuristic 'SE_MFA_LURE' indicates it's designed to harvest credentials by tricking users into approving MFA requests or entering one-time codes. The PDF contains a link farm with numerous external links, one of which is `https://fokemale.ru/strik?utm_term=can+you+use+ps4+camera+on+obs`, likely leading to a phishing page.
Machine Learning
- Nyx PDF Classifier malicious score 0.9960
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
MFA / one-time-code harvesting lure high SE_MFA_LUREDocument asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=can+you+use+ps4+camera+on+obs PDF link annotation
- https://sewowifef.weebly.com/uploads/1/3/6/0/136082850/mewip-fujazikibotutop.pdfIn PDF document text
- https://xagigerabep.weebly.com/uploads/1/3/1/4/131483632/8235997.pdfIn PDF document text
- https://fabebebu.weebly.com/uploads/1/3/2/7/132740756/11f843165dba.pdfIn PDF document text
- https://weralafopibobal.weebly.com/uploads/1/3/4/3/134338927/jupufisu.pdfIn PDF document text
- https://pidolanapeg.weebly.com/uploads/1/3/0/8/130813957/xuwugiwipuforami.pdfIn PDF document text
- https://bewapuvin.weebly.com/uploads/1/3/1/4/131453684/jused-kujovopiw-zevuf-zozetuso.pdfIn PDF document text
- https://bikekifo.weebly.com/uploads/1/3/5/3/135304891/9744038.pdfIn PDF document text
- https://tasukivokojut.weebly.com/uploads/1/3/4/5/134592673/zikox.pdfIn PDF document text
- https://jewupoma.weebly.com/uploads/1/3/1/4/131437657/zilawisemoxo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/9f116c95-898d-4773-9d08-ff8ecfde3b23/13028664516.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5a78052-18c7-4e33-855a-2183b11ba952/fovenodurotize.pdfIn PDF document text
- https://s3.amazonaws.com/geraromu/61712492398.pdfIn PDF document text
- https://s3.amazonaws.com/desekusoxi/bujavejitexabor.pdfIn PDF document text
- https://s3.amazonaws.com/wowonesoribu/adobe_reader_9._1_0.pdfIn PDF document text
- https://s3.amazonaws.com/vunizi/commonly_misspelled_words_middle_school_worksheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8f438c1-631c-4574-bda2-543dd5173b1c/kenmore_stacked_washer_dryer_model_417.pdfIn PDF document text
- https://s3.amazonaws.com/vajefam/zopelilipobe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3c1d585-9fa4-4f7b-b211-aebd6f17b2c8/addie_model_example_lesson_plan_ppt.pdfIn PDF document text
- https://s3.amazonaws.com/welanisowari/words_have_power_read_a_banned_book.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/113f1afa-d4e8-4476-bc28-d539067ae8b2/local_area_network_settings_windows_xp.pdfIn PDF document text
- https://s3.amazonaws.com/somisilegex/november_schedule_for_tcm.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/303d6784-7c57-45a7-a3a4-a27f2dbea346/61407783363.pdfIn PDF document text
- https://s3.amazonaws.com/polexebuj/maplestory_kanna_guide_2019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d1dffdf6-a5cf-40df-8596-7efb2bef41c2/chariots_of_the_gods_book_author.pdfIn PDF document text
- https://s3.amazonaws.com/nitizobuv/gagavegata.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa726d32-07a2-4e9b-9c06-0748ce5e57fb/10831852179.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f301.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF301 | 5284 bytes |
SHA-256: 2c736e0c16242e7adfc57add2a4fd2ece8f96e9a710a4c957156c273b4d63dea |
|||
font_01_sfnt_off000104f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104F0 | 10668 bytes |
SHA-256: 4f024bc1ed9f4296daa8ef102887e519f78dd09152f8a93b1a4ee37581bc278c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.