MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.7434
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xn--72ca1bzcdf9cg5df4n5a8cei.com/userfiles/files/75197896925.pdf In PDF document text
- http://campbellelectronics.com/uploads/kifavipelu.pdfIn PDF document text
- http://anton-joyeros.shopcloud.es/ckfinder/userfiles/files/84220801655.pdfIn PDF document text
- http://goddeal.cz/files/file/12903366627.pdfIn PDF document text
- http://www.albertoabajolimousin.com/abm/Bibliotecas/kcfinder/upload/files/naxoziwusepajavuzinesodug.pdfIn PDF document text
- http://vizitcard.kz/uploads/files/boletotevi.pdfIn PDF document text
- https://www.cultureowl.com/kcfinder/upload/files/fonisakubiti.pdfIn PDF document text
- http://xn--365-pn7mwb654m2qn.com/ckupload/files/14544255694.pdfIn PDF document text
- http://www.lacalzadadeoropesa.es/abm/Bibliotecas/kcfinder/upload/files/fosobarusejonalojese.pdfIn PDF document text
- http://capital96.com/userfiles/file/nofugewokizatewiba.pdfIn PDF document text
- https://sarenpinler.com/calisma2/files/uploads/28762189892.pdfIn PDF document text
- http://mpapir.ekopapir.com/images/files/71815069615.pdfIn PDF document text
- http://oembag.com/uploads/files/202203070112019481.pdfIn PDF document text
- http://suvenirzp.com/uploads/files/64200769743.pdfIn PDF document text
- http://www.salda.se/saldus/kcfinder/upload/files/16738243940.pdfIn PDF document text
- http://cn-biyoute.com/d/files/79584423707.pdfIn PDF document text
- http://bolsadetrabajo.lasalitas.com/sites/default/files/fckeditor/file/gegewulurarivibozimigosas.pdfIn PDF document text
- http://hoinhikhoavn.com/img/files/73763412901.pdfIn PDF document text
- https://hladiagnostico.com.br/kcfinder/upload/files/bukiwokororibavoxub.pdfIn PDF document text
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620b2010b1caa---jizadujofakaraj.pdfIn PDF document text
- http://kalecikliyiz.biz/panel/kcfinder/upload/files/67758332785.pdfIn PDF document text
- http://kpglearningbox.com/assets/kcfinder/upload/files/20378636110.pdfIn PDF document text
- https://etest.vn/app/webroot/uploads/files/nevoli.pdfIn PDF document text
- http://chhattisgarhsanskritboard.in/sharpinstitute/images/files/subagaze.pdfIn PDF document text
- http://ume.civilkozpont.hu/uploads/file/xoraxugesusekuzeda.pdfIn PDF document text
- https://tekdalyapi.com/upload/ckfinder/files/7213779588.pdfIn PDF document text
- http://awarelaxcentrum.cz/user_files/file/zezopejevonomizuwitotum.pdfIn PDF document text
- http://jplus-ag.com/upload/files/BodyFile__622D40CB0BE00.pdfIn PDF document text
- https://debcopharma.com/userfiles/file/43161974003.pdfIn PDF document text
- http://webursitet.org/kcfinder/upload/files/bujufil.pdfIn PDF document text
- https://cafij.co.za/XSRYdR1H?utm_term=geometry+transformations+review+packet+answer+keyPDF link annotation
- https://b2cdemo.tickets.com/content/files/47838465730.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00033923.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00033923.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00033923.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33923 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_01_sfnt_off00035043.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x35043 | 10992 bytes |
SHA-256: e305ad0674b218ed4960b5aafd8a1f63bd124cf04da0e0a1c6db3b9e4756a458 |
|||
font_02_sfnt_off000369ed.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x369ED | 17836 bytes |
SHA-256: 3a30fd88edbfe9b0085209a2f43659bd2344e3971713c995a521978634f6b5c4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.