MALICIOUS
106
Risk Score
Machine Learning
- Nyx PDF Classifier suspicious score 0.4999
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fecuq.co.za/XSRYdR1H?utm_term=connectors+of+addition+and+contrast+exercises+pdf PDF link annotation
- http://www.risingstars.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161ff3377cb472---gupodawese.pdfIn PDF document text
- http://mgrima.com/files/file/47211257125.pdfIn PDF document text
- http://xn--82cac8d3ajrc0gd0bo4a7nf3qg.com/userfiles/files/36961448773.pdfIn PDF document text
- https://nationaalbeloningsonderzoek.com/nieuwsbrieven/berichten/96682381736.pdfIn PDF document text
- http://mamolenasnc.it/userfiles/files/18229995390.pdfIn PDF document text
- http://jubileejec.com/userfiles/files/10683674860.pdfIn PDF document text
- https://wiercenie-studni24.pl/files/files/30826009197.pdfIn PDF document text
- https://independentmusicleague.com/wp-content/plugins/super-forms/uploads/php/files/aa756ab9ee7f6f0eb67187dc9c01c865/niwajekowovenotaf.pdfIn PDF document text
- http://primewritings.grand-essays.com/media/uploads/files/24217707973.pdfIn PDF document text
- http://casaperferiesantamariagoretti.com/writable/public/userfiles/file/mitulufusogi.pdfIn PDF document text
- https://eravukappalpalli.com/userfiles/file/gebesiduwisuwosofefikibam.pdfIn PDF document text
- http://startmatbaa.com/userfiles/file/19868634261.pdfIn PDF document text
- https://psiakocky-potisk.cz/webpagebuilder/ckfinder/userfiles/files/nipezufosuxataxufumuz.pdfIn PDF document text
- http://oldtimerclub-thueringerberg.at/images/file/kimisutimipenemuteviripo.pdfIn PDF document text
- http://thiennhanduong.com/ckeditor/kcfinder/upload/files/81269991787.pdfIn PDF document text
- http://figueredoyasociados.com/kcfinder/upload/files/19733692397.pdfIn PDF document text
- http://xn--j1aii.su/userfiles/file/34810069626.pdfIn PDF document text
- http://dolaninsurancetx.com/customcms/uploads/files/nejul.pdfIn PDF document text
- https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/1621ce94f815c1---83320757816.pdfIn PDF document text
- http://dtjxbpzx.com/filespath/files/20220207014645.pdfIn PDF document text
- http://technocom.pl/editor/file/63086695760.pdfIn PDF document text
- http://apexemergencias.com/images/files/tigubixozu.pdfIn PDF document text
- http://pileshoppen.dk/userfiles/file/55682183522.pdfIn PDF document text
- https://paixaodecristopi.cinemadossertoes.com/kcfinder/files/88524268073.pdfIn PDF document text
- http://ineb.izevo.cz/userfiles/file/95707469200.pdfIn PDF document text
- http://iq-money.ru/upload/files/widawudosigagelojofotala.pdfIn PDF document text
- http://loveperfectionschool.com/upload/file/20144841802.pdfIn PDF document text
- http://www.granito-terrazzo.be/ckeditor/kcfinder/upload/files/43809409270.pdfIn PDF document text
- http://www.tsahimmongol.com/uploads/images/files/50248632728.pdfIn PDF document text
- http://stefanourso.com/public/userfiles/file/60863930134.pdfIn PDF document text
- http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/lrs5b2jmbjpu6fu1jc7nd240u1/pasemajek.pdfIn PDF document text
- http://art-wonders.com/ckeditor/ckfinder/core/connector/php/uploads/files/wesesisegujoxoge.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00064f3d.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00064f3d.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00064f3d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x64F3D | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_01_sfnt_off00066658.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x66658 | 17032 bytes |
SHA-256: 338756154666f8aab0abeb38e34bfc226c83cf5764b6da9476939d86db8271d9 |
|||
font_02_sfnt_off000692a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x692A9 | 10700 bytes |
SHA-256: 8fe4666aa15d7319ed0a03824464956e0cb1a3d38b034bbaad595b4aab43076e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.