MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains numerous external links, many of which point to other PDF documents, suggesting a link farm or redirection mechanism for malware distribution. The heuristic 'LOLBin_RUN_COMMAND' and the presence of URLs like 'https://nipisod.ru/strik?utm_term=murder+mystery+dinner+show+orlando' indicate an attempt to trick users into visiting malicious sites. ClamAV detection further supports its malicious nature, likely as a phishing or trojan delivery vehicle.
Machine Learning
- Nyx PDF Classifier malicious score 0.6222
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=murder+mystery+dinner+show+orlando PDF link annotation
- https://cdn-cms.f-static.net/uploads/4484635/normal_6022010b60fbc.pdfIn PDF document text
- https://bunemanedadon.weebly.com/uploads/1/3/4/4/134476229/mekazuk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378836/normal_6051724c35254.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4503524/normal_6004e09dec74f.pdfIn macro / runtime command snippet
- https://cdn-cms.f-static.net/uploads/4385427/normal_601618beeca80.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4493597/normal_601ad5856c036.pdfIn PDF document text
- https://jowisatog.weebly.com/uploads/1/3/4/4/134403507/342e7209245701d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417140/normal_5fed925c1edd6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412767/normal_604b4d7cb1fa3.pdfIn PDF document text
- https://bazojosazim.weebly.com/uploads/1/3/6/0/136086377/pavuxez.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369914/normal_602977f9b5a74.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453334/normal_602687924e32d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uplIn macro / runtime command snippet
- https://uploads.strikinglycdn.com/files/5ba9e4b7-6209-49f1-9aab-c34d3fdcf0c2/windows_powershell_ssh_to_linux.pdfIn PDF document text
- https://s3.amazonaws.com/zijivevip/gekepizapetuwatunatixis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f085aac-5185-49d1-bf3b-1d7458d7bdf7/why_do_atoms_come_together_to_form_bonds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eae3028b-5803-4cd3-9a7e-2bde0c6368a9/what_order_do_you_read_warrior_cats_in.pdfIn PDF document text
- https://s3.amazonaws.com/farefasejikap/famivizivepisax.pdfIn PDF document text
- https://s3.amazonaws.com/kagedatabujo/suffixes_exercises_with_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2bb48efb-e03a-414d-8c8d-2b8f96f28d4e/whats_left_behind_netflix.pdfIn PDF document text
- https://s3.amazonaws.com/ragejufa/lilizogizomiwutonejuju.pdfIn PDF document text
- https://s3.amazonaws.com/timituvupame/camino_frances_etapas.pdfIn PDF document text
- https://s3.amazonaws.com/xufaxoferugod/88975392127.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.