MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, many pointing to disposable hosting, and one prominent URL suggests a lure for a 'michael jordan the life pdf free download'. This pattern is consistent with phishing or malware distribution, where a seemingly innocuous document is used to redirect users to malicious sites. No scripts were extracted, but the overall structure and URL usage point towards a phishing or downloader attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9984
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=michael+jordan+the+life+pdf+free+download PDF link annotation
- https://cdn.sqhk.co/woragumokewi/KYngghc/download_vertigo_racing_mod_apk_1._0._4.pdfIn PDF document text
- https://cdn.sqhk.co/gofelaxes/eqKjazo/dhoom_3_nepali_box_office_collection.pdfIn PDF document text
- https://rexawalifutox.weebly.com/uploads/1/3/4/4/134458468/6581092.pdfIn PDF document text
- http://fasekafalig.scienceontheweb.net/will_the_lg_stylo_5_get_android_10.pdfIn PDF document text
- https://sonelalakilo.weebly.com/uploads/1/3/4/4/134400406/duxomumawuvuleg_zolas_tikixugosu.pdfIn PDF document text
- https://damemerivojed.weebly.com/uploads/1/3/4/3/134378109/9036029.pdfIn PDF document text
- https://cdn.sqhk.co/guwuweri/jcEUQh8/temple_jungle_run_game_download_uptodown.pdfIn PDF document text
- http://fezufizibum.mypressonline.com/mixed_approach_to_research.pdfIn PDF document text
- http://bikelumonekodex.mygamesonline.org/golds_gym_xr45.pdfIn PDF document text
- https://cdn.sqhk.co/vadafepagij/gejafX3/gang_battle_simulator.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/a87048a8-5902-491e-9859-74a321da8ac6/batevevesenedepegoxogat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f72e2d88-b2a3-4b30-8834-45d6dc9a99af/how_to_write_a_letter_of_purpose_for_scholarship.pdfIn PDF document text
- http://kugugoroxe.rf.gd/credit_report_authorization_form.pdfIn PDF document text
- http://dodigemadepa.epizy.com/bypass_apk_samsung_j5.pdfIn PDF document text
- http://pemukusa.epizy.com/kedagolem.pdfIn PDF document text
- http://lubuzozerewa.rf.gd/what_is_a_good_psi_for_a_pressure_washer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f7498981-d496-4431-a2c9-e3b7326c4754/john_deere_zero_turn_mower_for_sale_australia.pdfIn PDF document text
- http://valupakukav.myartsonline.com/ccna_routing_and_switching_200_125_study_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/efb0e88a-4f44-4845-8e08-90a19acf11b5/dakapekezinojaxerizaxu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d52b9e49-8cd2-4b78-a594-49a58aad7cf7/how_do_i_add_a_to_my_kindle_app.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cbdc446d-76d1-40b1-a2c7-8454a7c6aa76/zipamavezesa.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000263da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x263DA | 5028 bytes |
SHA-256: 3dbfe3691032d2a95d6ed882eefd489f289e7b79ba80dc79445b9837442f7645 |
|||
font_01_sfnt_off000274f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x274F0 | 12180 bytes |
SHA-256: 354f34b6e1dd3a7df9f81694776b057515308453fbee7c3eda45706f50d05628 |
|||
font_02_sfnt_off00029dc5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x29DC5 | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.