MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm designed to distribute other PDFs. The document body, though heavily obfuscated, suggests a lure related to 'assessment answers'. The presence of external URIs and the link farm heuristic strongly indicate a phishing or malware distribution attempt, likely leveraging spearphishing attachments as the initial access vector. No scripts were extracted, but the PDF structure itself facilitates the redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9967
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/123?utm_term=level+2+bksb+english+diagnostic+assessment+answers PDF link annotation
- https://gokatejasefe.weebly.com/uploads/1/3/4/6/134650338/98759f61e.pdfIn PDF document text
- http://rowaxuxot.22web.org/examples_of_comments_for_kindergarten_report_cards.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450730/normal_6052f1430d4a4.pdfIn PDF document text
- http://kowezuzapine.66ghz.com/how_do_i_reset_the_icemaker_on_my_samsung_refrigerator.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410976/normal_601be673e9a37.pdfIn PDF document text
- https://lolemifazez.weebly.com/uploads/1/3/1/8/131871650/nigorijifonikatopow.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403689/normal_602695c4ac938.pdfIn PDF document text
- https://tugemizibu.weebly.com/uploads/1/3/0/7/130739278/1190460.pdfIn PDF document text
- https://tekuxarutupun.weebly.com/uploads/1/3/0/7/130775258/bde199edf5a.pdfIn PDF document text
- https://gidixolatuloxag.weebly.com/uploads/1/3/1/0/131071157/texixakunukofilede.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415321/normal_602fbff15010a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4390371/normal_5fe2d8892adca.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gozifep/dukogujixiw.pdfIn PDF document text
- https://s3.amazonaws.com/tevomenil/wovawitatugasitanewamet.pdfIn PDF document text
- https://s3.amazonaws.com/saxefi/vusigili.pdfIn PDF document text
- https://s3.amazonaws.com/tarajix/80794522921.pdfIn PDF document text
- https://s3.amazonaws.com/defipedibe/endocannabinoid_system.pdfIn PDF document text
- https://a8fdb364-3865-4521-a36b-e12f4de7752f.filesusr.com/ugd/e20637_63a626ec3fff4483818962bf290aaedb.pdf?index=trueIn PDF document text
- https://aa700e4b-9450-4a85-8b7e-8c92ffe47626.filesusr.com/ugd/de972d_8253e2731e0940a2bb94b9bf7cd7a94e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wuzalugiseto/are_all_coroners_reports_public.pdfIn PDF document text
- http://joxepivebafugig.epizy.com/agricultural_machinery_and_equipment.pdfIn PDF document text
- http://getijus.epizy.com/83895472604.pdfIn PDF document text
- https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_8bb14bae84d24cb5a7ff2b01019eea25.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nuvukivaxiren/gozolimuputupikiso.pdfIn PDF document text
- https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_c5afb54cb5cb47eea33a21bd469544c3.pdf?index=trueIn PDF document text
- http://rozejogore.rf.gd/warlock_5e_patrons_great_old_one.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010026.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10026 | 5784 bytes |
SHA-256: 4507345c2ebb6245764c414a3f282a5abf348e250a759589ef9f0b7e6dafced1 |
|||
font_01_sfnt_off000113c5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x113C5 | 10844 bytes |
SHA-256: 0edf6454e6462a081a72f17755cb7d088924686723e8c68bfa32ccfa59bda5e6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.