MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'nipisod.ru', which is likely a malicious domain used for phishing or malware delivery. The document body, though heavily obfuscated, suggests a lure related to 'abstract thinking test pdf'. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/award?keyword=abstract+thinking+test+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4491157/normal_6026e2e1bd861.pdfIn PDF document text
- http://jonotijero.medianewsonline.com/ssc_stenographer_model_question_papers_with_answers.pdfIn PDF document text
- http://vaxetopurorebi.iblogger.org/ms_project_2019.pdfIn PDF document text
- https://cdn.sqhk.co/tememagitapo/iaBgifT/58348051964.pdfIn PDF document text
- https://cdn.sqhk.co/vovusupa/aiYhcjg/28893338470.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413109/normal_605d82e27dfbc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411691/normal_6021a5f88a09c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403128/normal_605f2bc7207a0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411683/normal_6054731a3f8e2.pdfIn PDF document text
- https://cdn.sqhk.co/fakosopalo/Vxheia7/digestive_tract_definition_zoology.pdfIn PDF document text
- http://letinebab.mywebcommunity.org/69200477145.pdfIn PDF document text
- http://ravevuzovije.mywebcommunity.org/how_many_pages_are_in_the_book_midnight_sun.pdfIn PDF document text
- https://cdn.sqhk.co/wugeguxu/NjguhhN/questions_to_ask_someone_running_for_local_office.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4a7bf35d-3c3b-4842-86fb-4eef2fee0f5d/z_score_problems_worksheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4f2c1508-4819-4c6b-b5bd-51f1c485491d/how_to_do_a_factory_reset_on_amazon_kindle_fire.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36ada1f3-73c0-4566-824f-d12deef75aca/50044651816.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9abda1d2-bff7-4da2-b992-108423c55c7b/how_to_read_an_ekg_strip_made_easy.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/88b0a24d-a7ea-4a2b-86aa-9e3314ff9814/can_i_delete_ntuser.dat.log1.pdfIn PDF document text
- http://tupenanuziki.epizy.com/47238830093.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/54f39867-a5fb-4ac6-bbf5-fc30339a230a/its_even_worse_than_it_looks_ebook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2316f564-5c74-449f-8887-a3141995ca9e/ashton_woods_eastmark_claridge.pdfIn PDF document text
- http://sutexuvidag.myartsonline.com/fluke_t5-1000_parts.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efaf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFAF | 5576 bytes |
SHA-256: 3b58bd4dd8c335d38e22a48c8d646e4f8975fce0270f8bb9eb6e9b4cc4eb0512 |
|||
font_01_sfnt_off0001029e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1029E | 10508 bytes |
SHA-256: 6102c0a8a5c561c6150e27d7204846742f49cf67562f9853901a6268eb02f2c0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.