MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by an ML classifier and contains heuristics indicating it's an SEO redirector for a free-download phishing scam. The document body, though heavily obfuscated, contains a URL that aligns with the heuristic findings. The presence of numerous embedded URLs and the nature of the heuristics suggest an attempt to direct the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9962
Heuristics 5
-
Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAMDocument repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/wix?keyword=naruto+alternate+universe+sasuke+police PDF link annotation
- http://itmax.info/what_are_the_coolest_sheets_for_summerrvbwz.pdfIn PDF document text
- https://bapoxaluw.weebly.com/uploads/1/3/4/7/134717037/4961557.pdfIn PDF document text
- https://cdn.sqhk.co/fajoliteve/Ytjcgd3/gears_logic_puzzles_mod_apk.pdfIn PDF document text
- https://cdn.sqhk.co/nifijagik/cs6i4fC/nail_biting_meaning_medical.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479223/normal_5ff6bfc38629f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4491686/normal_5fcfb6cd60993.pdfIn PDF document text
- http://luminar3-download.xyz/masakoribedotimezcnqy3.pdfIn PDF document text
- http://olx-delivery.cc/nasejepepikokajoned0ann7.pdfIn PDF document text
- https://cdn.sqhk.co/wojusipi/Sfifzqz/luguvuxijeroz.pdfIn PDF document text
- https://tezefidusipenu.weebly.com/uploads/1/3/1/8/131857758/f3e2eda5c.pdfIn PDF document text
- http://bigno.space/326137709862luxh.pdfIn PDF document text
- http://latencfsrt.space/mckinsey_healthcare_analytics_reportra5hz.pdfIn PDF document text
- https://cdn.sqhk.co/gonolesuzam/gejbG50/nodufepa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4485826/normal_5ffec2ca1cc16.pdfIn PDF document text
- http://www.ascendercorp.com/In extracted file (font_01_sfnt_off000310d5.bin)
- http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_01_sfnt_off000310d5.bin)
- https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_fac328392a234612a932cea489f81818.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pazerogasarinu/arthrobacter_globiformis_atcc.pdfIn PDF document text
- https://ff06b2c9-6223-4357-b4d5-1bf3807c749f.filesusr.com/ugd/717131_3c39e8ef96ad4d51901fbc05abcbc4f8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/niporofez/gw2_weaponsmith_discovery_guide.pdfIn PDF document text
- https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_dcd5b8c8bc994fe2a7a8bb5ccf77e741.pdf?index=trueIn PDF document text
- https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_58650aa63336417ea911cb189b9bf77d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kotenu/good_morning_photo_friend.pdfIn PDF document text
- https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_7325bfc3db2540ae9620817b46e4b268.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn extracted file (font_01_sfnt_off000310d5.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00025f01.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x25F01 | 58624 bytes |
SHA-256: 4b878f1a532e5ee2919cd9bc3f1288327d9e32bb4f07fc735709e9942a96129a |
|||
font_01_sfnt_off000310d5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x310D5 | 5020 bytes |
SHA-256: 2e3beff5fb487e0759e73c3879cacaae242b4a67c079132d52521f76e48a8f7d |
|||
font_02_sfnt_off0003220e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3220E | 14388 bytes |
SHA-256: 5d9a5b469291ea0866d743b336691cf77fbcc17670f60a114f46ef58bc7c6d63 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.