MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, with several pointing to suspicious domains like 'nipisod.ru' and 'lumacy.site', indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a malicious document designed to redirect users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=soleus+air+window+air+conditioner+and+heater PDF link annotation
- http://lumacy.site/ssb_screening_testglxzb.pdfIn PDF document text
- https://cdn.sqhk.co/kusewupudin/hixhahb/sequoia_capital_fund_management_llp.pdfIn PDF document text
- https://cdn.sqhk.co/zapimafe/jfOibid/free_robux_knife.pdfIn PDF document text
- https://cdn.sqhk.co/xixujipum/f0Jhjha/police_car_lights_and_sirens_for_sale.pdfIn PDF document text
- http://fkpravo.ru/la_biblia_reina_valera_hablada_mateodi717.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461525/normal_6027711384806.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4389805/normal_5ff9d93955ea9.pdfIn PDF document text
- https://cdn.sqhk.co/nuponoviva/ijjbfjb/41348166348.pdfIn PDF document text
- http://itash.space/bsc4success_monthly_mcqknxtm.pdfIn PDF document text
- https://cdn.sqhk.co/motuwezelu/l0KggZb/download_ball_brick_breaker_2_mod_apk.pdfIn PDF document text
- http://copyrightnotice-ig.com/groove_life_camo_watch_bandsa0htt.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382960/normal_5fce14dbcff51.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jivuxo/nhtsa_driver_distraction_guidelines.pdfIn PDF document text
- https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_94a75bfa33e4467ab589731bc3022b68.pdf?index=trueIn PDF document text
- https://e8c82854-2a0b-4c0f-82de-bac600ce06e6.filesusr.com/ugd/d017d5_1db08b02cc364577bbc36ff2e2db7460.pdf?index=trueIn PDF document text
- https://60883313-e483-4213-bdf2-3844198a3b35.filesusr.com/ugd/3ba96b_aa78fe991cde4463b03577691a1df4fd.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kotenu/fabonevejunef.pdfIn PDF document text
- https://d90bda3b-35dd-409f-9d4b-b4a00d881a52.filesusr.com/ugd/b88e3d_e51944ad67b046d0a52bb826590da75d.pdf?index=trueIn PDF document text
- https://383fd46b-cc41-47b7-9379-19c19d7bb1fe.filesusr.com/ugd/81c43a_46bdd7998acb4de6b57fd920914fd5de.pdf?index=trueIn PDF document text
- https://a9f3490c-def6-45ea-9957-aefa341d54bd.filesusr.com/ugd/84b587_a780edc8907d4bb8a641660b037415c5.pdf?index=trueIn PDF document text
- https://ad323f3e-245e-4e3c-8b16-de91fefec063.filesusr.com/ugd/5ea691_39a19f9c0c574507a5cd7ad021071bd5.pdf?index=trueIn PDF document text
- https://aaf8962b-2ea5-4403-bfea-7c32f2b3f77e.filesusr.com/ugd/8f3a65_7ab1da0541904bd2a85b72aaab31a03b.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed65.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED65 | 5224 bytes |
SHA-256: 3ecf4a43334f36eda5e19d1b5db18b37b547f32605bee9bacac28bec8a39dbb9 |
|||
font_01_sfnt_off0000ff32.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF32 | 11168 bytes |
SHA-256: 59ca965f51f62c6eb9e35f98dcb3baf36d1651dc1e2b1274eee2ff94846cb940 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.