MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with one prominent URL pointing to a site related to 'walmart assessment test'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or a scam. The PDF structure and embedded links suggest it's designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://garglob.ru/pbw?utm_term=how+to+take+walmart+assessment+test+again PDF link annotation
- https://bemikazuriku.weebly.com/uploads/1/3/4/6/134648669/3314210.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500895/normal_60393b6000d9b.pdfIn PDF document text
- https://kowirakixodoxe.weebly.com/uploads/1/3/4/4/134467502/1809344.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4492586/normal_5ff6850211eda.pdfIn PDF document text
- https://buvewetaki.weebly.com/uploads/1/3/0/7/130775635/xikegitu.pdfIn PDF document text
- https://teligodinawam.weebly.com/uploads/1/3/4/4/134457670/9a76bee.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405895/normal_603cfdabc1043.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383156/normal_6015e9a633f9a.pdfIn PDF document text
- https://vorujefam.weebly.com/uploads/1/3/4/3/134322124/vazuduwarized-lasuzukusaj-womufini.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/67323b1f-cca3-4c52-87da-19e0408835f4/87217974140.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7607e10-0dac-4005-88fe-269a797cb871/samsung_s5_active_max_sd_card.pdfIn PDF document text
- http://kiletejude.pbworks.com/f/how_to_get_rid_of_wicked_whims_mod.pdfIn PDF document text
- http://pubetejidewi.pbworks.com/w/file/fetch/144695157/prentice_hall_algebra_2_pdf_download.pdfIn PDF document text
- http://joraxakegeg.pbworks.com/w/file/fetch/144651000/how_to_open_ipynb_files_in_spyder.pdfIn PDF document text
- http://mutatalibo.pbworks.com/w/file/fetch/144427311/renobenebavijegifodevuj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bace2758-2d67-4f1e-ba76-ad1e9762a16b/fexufujoluzilagon.pdfIn PDF document text
- http://jilawuxifi.pbworks.com/w/file/fetch/144659241/mavibagobejekaw.pdfIn PDF document text
- http://nerobedevu.pbworks.com/f/internal_audit_report_format_in_word_download.pdfIn PDF document text
- http://didaneguk.pbworks.com/w/file/fetch/144427851/fanuc_series_ot_parameter_manual_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2547b60e-7068-4543-8774-e88d451c2c37/necchi_sewing_machine.pdfIn PDF document text
- http://nefusim.pbworks.com/w/file/fetch/144455112/sri_suktam_sanskrit.pdfIn PDF document text
- http://pimepovume.pbworks.com/w/file/fetch/144481098/mortal_kombat_trilogy_cheats_pc.pdfIn PDF document text
- http://jolunatimavu.pbworks.com/w/file/fetch/144713772/barbie_in_a_christmas_carol_full_movie_in_hindi_part_4.pdfIn PDF document text
- http://zufogopojut.pbworks.com/f/yamaha_fjr1300_service_manual_2006.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eedd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEDD | 5124 bytes |
SHA-256: d8cdbd249ba26ddb27c135d5f26b82905e6cf15249bf215502e45e0739b63837 |
|||
font_01_sfnt_off00010047.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10047 | 11104 bytes |
SHA-256: 2a44bc43cd1e5ab6f75c07d7bab0f5b33604dcd2c0754fe686f708a72800fbf3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.