MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF is identified as a phishing lure due to its image-only nature and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates a typical phishing shape where a screenshot hides an attacker-controlled URL. The presence of numerous external links, including one to 'druttle.ru', further supports this assessment. ClamAV also flagged this file as a 'Pdf.Phishing.Trojan'.
Machine Learning
- Nyx PDF Classifier malicious score 0.6700
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/strik?utm_term=video+games+new+york+facebook
- https://static.s123-cdn-static.com/uploads/4403948/normal_5ff26474b9564.pdf
- https://cdn-cms.f-static.net/uploads/4445333/normal_5fea10c746ffd.pdf
- https://panonalosisewe.weebly.com/uploads/1/3/5/3/135316392/e21f2d429fca.pdf
- https://zujolifuwumew.weebly.com/uploads/1/3/4/7/134773321/6927701.pdf
- https://cdn-cms.f-static.net/uploads/4459917/normal_5fd7c1f1e99ea.pdf
- https://cdn-cms.f-static.net/uploads/4470521/normal_60207f3d6a994.pdf
- https://cdn-cms.f-static.net/uploads/4500674/normal_5fd650f6b9fe9.pdf
- https://futixaxez.weebly.com/uploads/1/3/4/5/134516919/1352136.pdf
- https://zavodazokexa.weebly.com/uploads/1/3/4/6/134632977/9721099.pdf
- https://marotebage.weebly.com/uploads/1/3/4/7/134712984/sosibamomabe.pdf
- https://uploads.strikinglycdn.com/files/9a3331a4-003a-4adf-ae31-cc22fc8407fa/best_rated_pool_salt_system_system.pdf
- https://uploads.strikinglycdn.com/files/01d2d910-fee4-4b1d-92b5-48f4a453bea7/cant_install_adobe_acrobat_pro_dc.pdf
- https://s3.amazonaws.com/dogazisuze/18061851432.pdf
- https://uploads.strikinglycdn.com/files/4f672c8a-547d-46f5-9571-a1d4391f34e4/73631867310.pdf
- https://0fecb50d-c8db-4b5c-a67e-01a13b1c0e9a.filesusr.com/ugd/da7c2d_4b53ba47ab4b4a528d7acac8631ced1d.pdf?index=true
- https://def05634-b969-4265-beeb-1e7d695e9a44.filesusr.com/ugd/6865ce_5aec631923654f50af8e0b62260f7765.pdf?index=true
- https://uploads.strikinglycdn.com/files/ae4da43d-e3ed-45a8-81e6-dcc8517726b8/25083019937.pdf
- https://s3.amazonaws.com/papuja/risoriwe.pdf
- https://uploads.strikinglycdn.com/files/5716ad0b-660b-47b9-bb4c-c73296804111/xijesokapagomunorejutiz.pdf
- https://s3.amazonaws.com/nisoxow/yin_rk._case_study_research_design_and_methods.pdf
- https://uploads.strikinglycdn.com/files/5bda3e53-a2b3-4459-ac45-9439037e522d/cateye_mity_3_reset.pdf
- https://s3.amazonaws.com/luropi/87899602016.pdf
- https://uploads.strikinglycdn.com/files/3dab3e6d-c86c-4f3e-9d54-87adee980668/fire_and_blood_audiobook_chapters.pdf
- https://uploads.strikinglycdn.com/files/01656c17-945c-41a9-9c30-af4562b4b8fa/3_5_8_pulgadas_a_milimetros.pdf
- https://uploads.strikinglycdn.com/files/1ca5999c-9629-4f52-8059-258072d88cd2/lol_patch_notes_10.24b.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.