MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is a PDF that appears to be an image-based lure, typical of phishing campaigns. It contains numerous external links, including one pointing to a potential link farm, and is flagged by ClamAV as a phishing trojan. The ML classifier also indicated a high probability of maliciousness. The document body is heavily obfuscated and unreadable, but the presence of external URIs and the overall structure strongly suggest a malicious intent to redirect users to potentially harmful websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.7086
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 48 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/award?keyword=cernobiljska+molitva+knjiga+pdf
- http://alsamcctv.com/kazogilopudumusanenamospy721.pdf
- http://kind-insta.site/kodavakowubivp60c6.pdf
- https://static.s123-cdn-static.com/uploads/4402478/normal_5ffb6b8d9a28d.pdf
- https://modibidusez.weebly.com/uploads/1/3/4/0/134096811/xajujomobu.pdf
- http://milanomoda-italy.site/581278611720ba8m.pdf
- https://kimilirakafame.weebly.com/uploads/1/3/4/6/134659192/mozovobirerinif.pdf
- https://xibigulekin.weebly.com/uploads/1/3/0/9/130968960/6805406.pdf
- https://cdn-cms.f-static.net/uploads/4453906/normal_60437a08cafd3.pdf
- https://static.s123-cdn-static.com/uploads/4378405/normal_5fc799e241f5b.pdf
- https://cdn-cms.f-static.net/uploads/4449187/normal_603e664644b3b.pdf
- http://tixshopclub.space/piriformis_function_in_hip_flexionaa18v.pdf
- https://mubuzetuwifo.weebly.com/uploads/1/3/4/7/134703000/tabaga-melitazisibol-jenovol-petexogegaredi.pdf
- https://cdn-cms.f-static.net/uploads/4368760/normal_6062a4bb06349.pdf
- http://vvinorama.fun/68488166621xm8oj.pdf
- https://cdn-cms.f-static.net/uploads/4425910/normal_6050252a07730.pdf
- https://wisiwojapano.weebly.com/uploads/1/3/4/8/134896472/861227c91.pdf
- https://cdn-cms.f-static.net/uploads/4417527/normal_603936bd91305.pdf
- https://uploads.strikinglycdn.com/files/a5f849c7-5459-4eab-af39-802fde4ff23e/maths_book_for_class_7_maharashtra_board.pdf
- https://uploads.strikinglycdn.com/files/40dcd5be-0391-4645-99b2-d6d62ac41813/crosley_record_player_cd_wont_play.pdf
- https://uploads.strikinglycdn.com/files/1b7e309d-1551-46f2-bbaf-450c60614c53/nikon_d40_specs_megapixels.pdf
- https://uploads.strikinglycdn.com/files/5c03cabd-a389-43ec-9b59-3bd3ae946aba/10629216254.pdf
- https://uploads.strikinglycdn.com/files/9b9623e6-53f1-45c9-ae28-2c0b214b07cb/lasonizevo.pdf
- https://uploads.strikinglycdn.com/files/92a92fab-4784-4e18-be47-b673effb1d4e/web_services_basics_tutorial.pdf
- https://uploads.strikinglycdn.com/files/04a3c6ba-1a5a-48d8-82d3-aa2b420e4fb7/first_aid_qa_for_the_usmle_step_1_2019.pdf
- https://uploads.strikinglycdn.com/files/0ac94647-88d4-4132-afbc-07777880cdd0/48471003472.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.