MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to phishing sites. ClamAV detected this file as a phishing trojan, and ML classification strongly supports its malicious nature. The embedded links, such as 'https://leonvi.ru/wix?keyword=rappelz+how+to+get+master+classes', are likely part of a link farm or phishing campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/wix?keyword=rappelz+how+to+get+master+classes
- http://lnstagram-verificationbadgeform.com/72048916224aoy0l.pdf
- https://pikoxujedogusu.weebly.com/uploads/1/3/4/6/134665618/kezoj.pdf
- https://kuvomudoriri.weebly.com/uploads/1/3/1/4/131406544/safesozajopun.pdf
- https://static.s123-cdn-static.com/uploads/4489061/normal_60001710820b8.pdf
- https://vawilateg.weebly.com/uploads/1/3/4/6/134697686/jogusakul_vagenexodator_fovedo.pdf
- https://cdn-cms.f-static.net/uploads/4422658/normal_5fe938a68ffbd.pdf
- https://ronupajowosoza.weebly.com/uploads/1/3/4/8/134871490/911daa1.pdf
- http://awpmode.com/reglage_richesse_moto_4_cylindrevz7lk.pdf
- https://valuluxunu.weebly.com/uploads/1/3/2/7/132710491/3713160.pdf
- https://kitozegukelod.weebly.com/uploads/1/3/6/0/136056839/fa83bf94.pdf
- https://jomezafivawig.weebly.com/uploads/1/3/1/8/131856232/4469319.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/xixonu/blockbuster_video_song_pagalworld.pdf
- https://s3.amazonaws.com/tazopaju/emulator_android_linux_ubuntu.pdf
- https://s3.amazonaws.com/bulozor/all_cheat_games_on_android.pdf
- https://s3.amazonaws.com/posaxugidut/catalogo_avon_campagna_16_2019.pdf
- https://s3.amazonaws.com/dumupa/cessation_of_business_form.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015e42.bind78197f634649383bfb45f008aa4fca651466f51d40ccc15341900b2036fdb4a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15E42 | 5496 bytes |
font_01_sfnt_off000170e9.bin5b85f628e85c4f15939c3dffe7e0e6cd65dbc25a501f1350888a688fbc200d50 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x170E9 | 12924 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.