MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious phishing content. It contains a large number of external links, suggesting a link farm designed to distribute malicious content. The primary URL, 'https://oniceh.ru/pbw?utm_term=youtube+cara+download+gta+san+andreas+di+laptop', appears to be a lure for downloading a game, which is a common social engineering tactic. No scripts were extracted, but the PDF structure and numerous external links indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9985
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/pbw?utm_term=youtube+cara+download+gta+san+andreas+di+laptop
- https://cdn-cms.f-static.net/uploads/4408333/normal_6059bd15a57d0.pdf
- https://marezupudi.weebly.com/uploads/1/3/0/8/130874377/godek.pdf
- https://cdn-cms.f-static.net/uploads/4414342/normal_5fd271bbc72cc.pdf
- https://zodajuxos.weebly.com/uploads/1/3/4/2/134235393/9683138.pdf
- https://static.s123-cdn-static.com/uploads/4447641/normal_5fe515340b8ce.pdf
- https://vanevuzitikuge.weebly.com/uploads/1/3/4/5/134588875/goboxekuwib.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/5d1fb2b1-9e68-43bb-bed4-81765fa0ce89/hansel_vs_gretel_2015_movie_ratings.pdf
- https://uploads.strikinglycdn.com/files/1409275b-54f3-487b-8fc5-6cd5547e9b63/73158213317.pdf
- https://uploads.strikinglycdn.com/files/d6f283a4-4788-49ba-9678-db2d5b03033d/zugekomijudup.pdf
- https://uploads.strikinglycdn.com/files/f3550331-baae-407a-bfa1-d9bf6c159007/granny_mod_minecraft_1.12_2.pdf
- https://uploads.strikinglycdn.com/files/7a799c4f-b392-4160-ad06-d51c6c5e46e3/retos_matematicos_para_nios_de_cuarto_grado.pdf
- https://uploads.strikinglycdn.com/files/9c624285-c72b-4235-a6e1-5df42a36cdaa/urgent_care_doctor_salary_california.pdf
- https://uploads.strikinglycdn.com/files/caa55818-2d54-46c7-9d9a-54c67f420ec8/pabakosolup.pdf
- https://uploads.strikinglycdn.com/files/f153f7ac-83cf-4976-a6d9-fbb1360f5ff0/how_to_add_zoom_filters.pdf
- https://uploads.strikinglycdn.com/files/66d3f727-b3ab-4a34-a830-5f3da6263b4c/sudidi.pdf
- https://uploads.strikinglycdn.com/files/05694e53-25da-4ef0-9fa6-ee056e4d5f9f/ecology_of_the_planted_aquarium_free.pdf
- http://gapufipi.pbworks.com/f/comparative_and_superlative_adjectives_activities_online.pdf
- https://uploads.strikinglycdn.com/files/2208e531-1b35-4f1d-8c16-67c06b35a121/what_is_a_meet_and_confer_declaration.pdf
- https://uploads.strikinglycdn.com/files/e0f96dc4-261d-4707-9d32-c2fe1a21a42b/brownie_safety_award_pin_activities.pdf
- https://uploads.strikinglycdn.com/files/eb326211-d2a6-400d-8daa-f0e25f52f9fd/samsung_un32j4000ef_manual.pdf
- http://visetululiv.pbworks.com/f/43942838024.pdf
- https://uploads.strikinglycdn.com/files/9c6e4ad0-65c9-495b-bac8-d870163399d9/56085407025.pdf
- https://uploads.strikinglycdn.com/files/c2ae188f-fe68-4ade-a34a-210c59d57d6c/how_to_remove_pimple_spots_overnight.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec6d.bin0618e5a2d4e122f66362095a9ba14869123d3abb56398954c9f007c2f2c31d3a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC6D | 5436 bytes |
font_01_sfnt_off0000ff02.bin6d2a3a16cc464ce72cf05976c7f96a31c93af2202e0dc760c37a694345e222ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF02 | 1800 bytes |
font_02_sfnt_off00010792.bin388a9caf0ff0a261962119f9fcfaa8603965bb876260978bec57b4f78576844e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10792 | 12396 bytes |
font_03_sfnt_off00013019.bin4954ddec54c61b6acc7eddbac306bc890d05f3afdfcf3ae890c7612da0a7d668 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13019 | 16376 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.