MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to disposable hosting, suggesting a link farm or phishing lure. The presence of PDF-specific heuristics like PDF_SEO_DISPOSABLE_LINK_FARM further supports this, indicating the document is designed to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=easy+vegetarian+dishes+for+picky+eaters PDF link annotation
- http://nafewid.sportsontheweb.net/zilitipidabofesan.pdfIn PDF document text
- http://buxeletifexid.medianewsonline.com/mcdonalds_uae_menu.pdfIn PDF document text
- http://kogemotuju.getenjoyment.net/fuwewigudunefipebito.pdfIn PDF document text
- http://fonixeguga.mywebcommunity.org/wordly_wise_3000_teacher_s_resource_book_7.pdfIn PDF document text
- http://pedagodogiko.getenjoyment.net/how_to_speak_mandalorian.pdfIn PDF document text
- http://vumonivaxozutod.mypressonline.com/bcd_7_segment_decoder.pdfIn PDF document text
- http://lafutib.sportsontheweb.net/fungsi_kurikulum_pendidikan_islam.pdfIn PDF document text
- http://tuzotumefakorok.scienceontheweb.net/arthritis_uk_back_pain_exercises.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://c0b8f06b-4e98-4d3d-89ef-2f08caba629a.filesusr.com/ugd/0c8cc8_28873a8bc80142b7aef507884f363091.pdf?index=trueIn PDF document text
- https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_ad7160d602114cce8f38bcc4ba1c80b6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/258a8153-7eb3-4a68-95bc-13bcd6125763/how_to_cure_a_bump_on_your_lip.pdfIn PDF document text
- https://s3.amazonaws.com/jevedijadiki/street_stick_fighter_mod_apk.pdfIn PDF document text
- https://s3.amazonaws.com/kikunojulejuj/25986435142.pdfIn PDF document text
- https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_88c739f64785428793f1b24c421c6068.pdf?index=trueIn PDF document text
- http://niwimugosaz.onlinewebshop.net/69742571804.pdfIn PDF document text
- https://s3.amazonaws.com/rubidokezive/40103817764.pdfIn PDF document text
- https://s3.amazonaws.com/nufidibodudulad/vikigumitifefasotalizojem.pdfIn PDF document text
- https://46fb9a51-9e16-4ad8-811e-2f7ed01702f7.filesusr.com/ugd/53363c_51124718679e4a2d89652617ae15271a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b5b389ca-ea35-461b-80e5-54f480ec4927/are_all_kidde_smoke_detectors_compatible.pdfIn PDF document text
- https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_dfe87d1beff942e385258804a2185ec4.pdf?index=trueIn PDF document text
- https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_f9e4f9f3e5ce45d18ebdfb763ec4a4d8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/49d93ee0-09fd-4a25-8989-794f996c0d7f/casio_g-shock_mudman_solar_compass_9300.pdfIn PDF document text
- https://s3.amazonaws.com/wixanarer/kilovad.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f9ff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9FF | 5568 bytes |
SHA-256: 3b7869cedfe64a1122c5a3b3a44dae9e4039bd2961ad7b14cf6c43f59ac14ec7 |
|||
font_01_sfnt_off00010cff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CFF | 10760 bytes |
SHA-256: 57a5b3f21472a029b2c2beba58dd4b04747726362cc0a075b8f997312e2aa293 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.