MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with one specifically identified as an external URI pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a search result or similar lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=is+there+part+2+of+fifty+shades+of+grey PDF link annotation
- https://cdn.sqhk.co/nivavepe/HgjKihN/mokiluvabedogud.pdfIn PDF document text
- http://badgesverified.com/5833204865e88dn.pdfIn PDF document text
- http://hr-insider.com/loripiriribopikakezutormlsws.pdfIn PDF document text
- http://suberubepuparo.getenjoyment.net/xoxapupoxito.pdfIn PDF document text
- http://wegoradubi.sportsontheweb.net/fifilugemimuwi.pdfIn PDF document text
- https://cdn.sqhk.co/raserijene/BVicieR/outdoor_tabletop_electric_fireplace.pdfIn PDF document text
- https://cdn.sqhk.co/ralapogifur/M2MfYge/dj_sounds_effects_horn.pdfIn PDF document text
- http://securityverifiedservices.com/206482067922s6c0.pdfIn PDF document text
- https://cdn.sqhk.co/fopeziriga/gjiwgib/reincarcare_cartela_wind_online.pdfIn PDF document text
- http://tibudirowe.mygamesonline.org/zekotogekukuradeg.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://6f81cef9-66a2-447d-9e1d-4c0427ef15c5.filesusr.com/ugd/4d935e_d960fc9f73ce4277b0add7e007053094.pdf?index=trueIn PDF document text
- https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_d2865718102e49d99b07ac6d19b51648.pdf?index=trueIn PDF document text
- http://doxokalisawe.myartsonline.com/setelixi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0104d5b6-3317-4dfe-a317-7f8b3f3b6989/ge_ultrapro_universal_remote_codes_for_vizio_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1b445eb-78cd-4486-8232-671ea1b0f23d/oster_professional_a5_turbo_2-speed_equine_clipper_kit.pdfIn PDF document text
- http://bizotuku.epizy.com/lodebadet.pdfIn PDF document text
- https://f18b8dc1-3ce9-44bd-8712-01435d039869.filesusr.com/ugd/b97cba_a7703d8060b3497dbd1e0b1e2a5808a4.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e65acd7d-3774-4d21-9085-989c66b25acb/mekevopenosexife.pdfIn PDF document text
- http://movuzog.rf.gd/waluzit.pdfIn PDF document text
- http://jizabimumonox.rf.gd/reported_speech_positive_sentences_exercises.pdfIn PDF document text
- https://3796e7af-74f6-4269-b4b1-c98d6d9a2df3.filesusr.com/ugd/169b5e_d6cff28810594289b54446b52df95cec.pdf?index=trueIn PDF document text
- http://kalilom.epizy.com/notevonefisadikuvi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011c4d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11C4D | 5124 bytes |
SHA-256: af0089cc118c5fd1e06e49fc6b5c6fa6add96ee5b48748165ea7cec4222c00e2 |
|||
font_01_sfnt_off00012dd3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12DD3 | 13088 bytes |
SHA-256: 7f1bdff5029492129025579a83f2a44ba56e179e36cdc37d469fbf320af76d14 |
|||
font_02_sfnt_off00015935.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15935 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.