MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a significant number of external links, with the primary malicious URL being resalured.ru. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, suggesting a malicious intent to redirect users. ClamAV also detected this as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links strongly suggest a phishing or malicious redirection attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=imparfait+ou+pass%25C3%25A9+compos%25C3%25A9+exercices+cm1 PDF link annotation
- https://witomoniwitu.weebly.com/uploads/1/3/5/3/135317652/2273745.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421354/normal_60689070a858c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367000/normal_5fd16e38a7709.pdfIn PDF document text
- https://dedejabo.weebly.com/uploads/1/3/4/8/134875177/dosarufokizo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446035/normal_601535edb41a9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381104/normal_60691a53b451e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495849/normal_6023d78b8611b.pdfIn PDF document text
- https://fovivijidilel.weebly.com/uploads/1/3/4/8/134888041/kulukuvitit_nivobejowinagiv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/51f03373-5ac1-4aa4-a3c3-a4a87c38acb2/how_can_quantum_physics_help_us.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e669254d-4b38-4749-97d9-433a467f3cfb/how_much_does_a_music_examiner_get_paid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d42607de-da9d-4931-925d-cd850665b533/ejemplo_de_una_comunicacion_entre_dos_personas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2abf8006-aaf2-427e-91f6-21e2fbc5a0ef/26233703665.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b01f5e3c-2538-4082-84d6-88d6601c5997/nazovigalelukufev.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/516b4e1d-8b55-411e-99b9-630cf7b87b70/xosidikobise.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aaab3c26-628b-4729-9df1-1aa3210b4bc2/como_resetar_celular_motorola_xt1792.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/230a5c69-9bd9-44a0-bde7-1c8b33e969d0/netflix_code_aip-701.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d431b647-b69c-4187-937b-9b54cb3efff5/ley_de_educacin_del_estado_de_puebla_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d55e26ab-fa08-480a-ae83-32c9498c2deb/47658503981.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/40071856-b6f1-422b-a423-72238f8c4196/17910315993.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf7777fc-a540-43d1-9935-7ad47ca1587b/63756417202.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc326c27-3422-457f-ae83-e6028cb4d37a/saeco_xsmall_plus_espresso_machine_troubleshooting.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4812ed7d-02df-4fad-b6af-2f0b5a449cc9/liruwutavawodaxuvetawigo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee8cb452-b02e-46d3-8109-964ed39ade71/monikatifibotiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb542de6-b469-4106-bf98-aeda1018ef87/city_of_bones_movie_streaming.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4006b553-d039-4c00-b5cc-3981eb005ff8/xovagis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f160.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF160 | 5328 bytes |
SHA-256: 8f7b0e8cc9cd92c38345c73ef82e654a3efa1be1eab329ab922baac42b992e95 |
|||
font_01_sfnt_off0001032d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1032D | 12132 bytes |
SHA-256: abb1c8dcbf3b00fc4cb2d438a6615d4fc920e023f87c9bae41e5d392d03144d5 |
|||
font_02_sfnt_off00012a5c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12A5C | 16144 bytes |
SHA-256: 63a00075b6585576fde9faae807a183b846b293c24c764fa28757b45c8a5091c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.