MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It functions as a link farm, directing users to numerous external URLs, one of which is a known malicious domain. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of embedded URLs points towards a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9829
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/strik?utm_term=a+few+of+my+favorite+things+sound+of+music+lyrics
- http://bitagaratela.22web.org/gomegatuxiwuwox.pdf
- http://egrn-order.online/175182884894pw5a.pdf
- https://static.s123-cdn-static.com/uploads/4486563/normal_5fdf948a8c819.pdf
- http://sunny-web.ru/bodies_that_matter_quotesfz33y.pdf
- https://cdn-cms.f-static.net/uploads/4413238/normal_603f85208e0f8.pdf
- http://kufafukedexepix.mygamesonline.org/bofakojikeloziwelufe.pdf
- https://cdn-cms.f-static.net/uploads/4412891/normal_5fd9316df1e1a.pdf
- http://nekimul.22web.org/how_to_watch_star_wars_canon_in_order.pdf
- https://pejegenipejixe.weebly.com/uploads/1/3/4/8/134848799/vozad.pdf
- http://smartcoin.design/samsung_js8500_hdr_updatesfg7x.pdf
- https://letitunonagafi.weebly.com/uploads/1/3/4/4/134494227/b6efa2f8.pdf
- http://rezotu.xyz/5924856172493e6g.pdf
- http://mitisavad.getenjoyment.net/used_line_6_spider_iv_15w_1x8_guitar_combo_amp.pdf
- http://esagafow.fun/benobolokotaxoxesckgt.pdf
- https://cdn-cms.f-static.net/uploads/4382973/normal_5fd61218abfd1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://namakanexir.atwebpages.com/79390849947.pdf
- http://muvipifipu.rf.gd/what_is_the_loudest_roblox_id_2020.pdf
- http://nepafel.epizy.com/bern_switzerland_map.pdf
- http://bividit.rf.gd/total_war_warhammer_1_bretonnia_guide.pdf
- http://rapodebo.epizy.com/bumigumemivametogewirafop.pdf
- http://kadoxosin.atwebpages.com/english_phonetics_and_phonology_peter_roach_free_download.pdf
- http://nemusif.rf.gd/wugaletojaba.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c963.binad12a8124a78c74d1f64595cdd727b1db2e0c20f5c581e040c991160b1aeb9a5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC963 | 5676 bytes |
font_01_sfnt_off0000dca6.bin9c5a9ff9574e01609d23e420c77456013724a7740eb3e02f4b6eac941506cacf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDCA6 | 9896 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.