MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many of which are part of an SEO link farm designed to redirect users. One prominent URL, 'https://pelibifir.ru/award?keyword=basic+job+interview+questions+and+answers+pdf', is presented as a lure for job interview questions, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/award?keyword=basic+job+interview+questions+and+answers+pdf PDF link annotation
- http://nazevulilabume.66ghz.com/45812022798.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4367635/normal_6001da91b2648.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4365570/normal_5ff8819cc46ec.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366354/normal_5ffe1c607d7f0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://527ed197-5826-4432-9c89-449afa9d705e.filesusr.com/ugd/65ef70_6b10df1ee6fd4b3582b031dfd83e3a6b.pdf?index=trueIn PDF document text
- https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_0a2fa3556978481db91d0a3dac510291.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xakapudakadu/naziveni.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/951583f7-7fa1-473a-bbf6-e35f7736ac94/final_fantasy_xv_royal_edition_gameplay_xbox_one.pdfIn PDF document text
- https://s3.amazonaws.com/baposivarabuj/biblesoft_pc_study_bible_4_free.pdfIn PDF document text
- https://s3.amazonaws.com/vonutavekip/muperaxutovajidefimugu.pdfIn PDF document text
- https://48936d5e-4b15-4059-a328-ddb12afcc15e.filesusr.com/ugd/173145_1e26565fd68b432bad3f1d014e6f1d95.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vovuzize/afcat_2019_result.pdfIn PDF document text
- https://24451074-f53b-4065-993c-779ba3957988.filesusr.com/ugd/0ae25f_064baa3ddbc14c1db1caa93742b4df15.pdf?index=trueIn PDF document text
- https://123949be-7110-4ba3-a240-a7df06fb38ce.filesusr.com/ugd/80fd5d_50b5b93f9e694866848effbc6457cd3d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tomaxade/pokemon_quest_eevee_evolution_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/636f1c85-ada2-42e0-b54c-2af59d5b9586/hp_deskjet_6540_ink_levels.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ea16112-527b-46a8-988f-7eb96d01fcfd/ps4_gold_headset.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c42ed74-e83c-4380-8d2a-89f8c693cc66/bless_me_ultima_sparknotes_chapter_2.pdfIn PDF document text
- http://bonipoja.epizy.com/define_effectual_in_biblical_terms.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ded2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDED2 | 5540 bytes |
SHA-256: c2078806cfccd1f7368d673ca52e72c5675d89c36173bdb0f38cd41fc7cd0388 |
|||
font_01_sfnt_off0000f1b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1B5 | 10308 bytes |
SHA-256: 52e6d79c48a72997cd3f33aba7b4c9c52f1491347c8b3a1fdd4a26af66594893 |
|||
font_02_sfnt_off000114fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114FC | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.