MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains multiple heuristics indicating phishing and payment redirection lures, suggesting a business email compromise or scam. The presence of external links, including a link farm and a specific URL pointing to 'dugedepap.ru', further supports this. Although no scripts were extracted, the overall structure and heuristic firings strongly suggest a malicious intent to deceive the user into fraudulent financial transactions or to extract sensitive information.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LUREDocument describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/123?utm_term=can+a+jitterbug+phone+be+added+to+a+verizon+account PDF link annotation
- http://berozava.iblogger.org/visio_cross_functional_flowchart_template.pdfIn PDF document text
- http://detelibizonibi.22web.org/cg_dj_syk_tapori_mix_song.pdfIn PDF document text
- http://extraterrestrials.space/53847402622itto4.pdfIn PDF document text
- http://legendarycraft.ru/sniper_game_3d_free_sniper_game_2020_uptodowntvqb8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/mibiwivanetuj/what_questions_to_ask_a_technical_recruiter.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/911e287f-f75e-4866-80c3-fe771d4afc24/zoom_h2_manuale_italiano.pdfIn PDF document text
- https://s3.amazonaws.com/gisujubolidine/360_degree_face_shield_with_respirator.pdfIn PDF document text
- https://s3.amazonaws.com/bezegoluzose/what_is_a_power_structure_in_an_organization.pdfIn PDF document text
- https://a39ac558-8fe8-437d-9e10-dc9402d6cb9c.filesusr.com/ugd/1ebe14_f22ed8579d3d4dd3a3c11751116a2182.pdf?index=trueIn PDF document text
- http://tagitefidunun.epizy.com/practice_dna_structure_and_replication_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/kikunojulejuj/religious_definition_of_formalism.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/88640e15-fc6d-4499-b0bc-ad095225b67b/toverowibu.pdfIn PDF document text
- https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_c35d4fecff2b43aaa5d22e9f129e1423.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lokijuronig/gudesitujotikipurirebup.pdfIn PDF document text
- https://s3.amazonaws.com/faduxodiwo/all-_in-_one_wp_migration_import_premium.pdfIn PDF document text
- https://s3.amazonaws.com/remuv/alcatel_lucent_8028s_manual.pdfIn PDF document text
- http://zapibesug.epizy.com/distance-time_graphs_worksheet_answer_key.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af057549-84e7-418a-86af-b145d08ffda2/kindle_fire_hd_10_manual.pdfIn PDF document text
- https://s3.amazonaws.com/lunojol/52791603947.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001183f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1183F | 5356 bytes |
SHA-256: 2cfa8a3541ed0da2534d68975e34887a80ee657b5fe554dd1b76c2d4fdf4484f |
|||
font_01_sfnt_off00012a7c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12A7C | 11072 bytes |
SHA-256: 60de788b1c3184a4f077d75b4060b921d6341198a614a41f9a8a0a941858e792 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.