MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains heuristics indicating it is a link farm on disposable hosting, with a high ML score and ClamAV detection as Pdf.Phishing.Trojan. The embedded URL points to a domain associated with phishing attempts. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=how+to+scan+multiple+pages+into+one+pdf+epson+xp-200 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4389104/normal_5fed76521d376.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482847/normal_5fd368a3663e4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374857/normal_6009fb443b09d.pdfIn PDF document text
- https://cdn.sqhk.co/xawobovuji/jjgdLjc/dijetibelo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367303/normal_6019ff14ea8dd.pdfIn PDF document text
- https://cdn.sqhk.co/nutewakizi/hfhauja/amazon_prime_video_android_tv_apk_xda.pdfIn PDF document text
- https://cdn.sqhk.co/ledirevobep/ighjdTF/bareninevonexu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454436/normal_600e41302afca.pdfIn PDF document text
- https://cdn.sqhk.co/nilulugaj/xzAjgig/84082908457.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4383925/normal_5ff5127fc4e7f.pdfIn PDF document text
- https://cdn.sqhk.co/wajuletixex/ehjt60z/moderna_vaccine_trial.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://4a7d9d2b-1d67-446c-8d6d-bdd3043d1f60.filesusr.com/ugd/c3d078_a02f9812ccdd4329b75b1630f7d2f8be.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/37d1033c-6d64-4601-b439-0ec681b6efd2/dumupimilerev.pdfIn PDF document text
- https://s3.amazonaws.com/bezorito/cake_decorating_tools_list.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10ad2d4a-9266-4a56-a7bc-fabd9cb7bea4/the_kybalion_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e4b55c4-8ac4-472a-a730-5d4b6006475d/infinix_note_7_price_in_bangladesh_6_128.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0eb0b65-7821-4716-9428-30ca2f651d69/54011213558.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15b5cf0f-ed78-4c62-9365-85cdf728bf6c/beginning_c_through_game_programming_amazon.pdfIn PDF document text
- https://s3.amazonaws.com/lonozote/derivative_market_in_india_project_report.pdfIn PDF document text
- https://288c7b4b-0494-48f6-8ee2-9dd519b96b0a.filesusr.com/ugd/a107db_db40b526e1f741d2bcce458d7c148914.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jupevuxirapi/19500397513.pdfIn PDF document text
- https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_f22d2968152e4c32863499916eb2a079.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jidosatikim/hematology_mcq_with_answers.pdfIn PDF document text
- https://66f9c2bc-82a6-463d-9ccd-9c94d3d8805e.filesusr.com/ugd/b361c6_03c26ca58cd949f4974750d18d7d49c4.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e5ee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE5EE | 5808 bytes |
SHA-256: bfe3b6e0d67f04d4c62025ae201891f05704a537c7de45bafce6127899c47e4a |
|||
font_01_sfnt_off0000f9ca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9CA | 10856 bytes |
SHA-256: 122327084a38b9ecfaad9c751a1ebbd34e546171fe0eda955238b93e21d10ec4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.