MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, many pointing to disposable domains and employing UTM parameters, indicative of a link farm used for phishing or malware distribution. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links are consistent with techniques used to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=samsung+rf263beaesr%252Faa+ice+maker+removal PDF link annotation
- https://cdn-cms.f-static.net/uploads/4479942/normal_602fd8ad8a0ad.pdfIn PDF document text
- http://hhizmet.com/28749640117day04.pdfIn PDF document text
- http://sepukolobu.sportsontheweb.net/how_to_prepare_for_cultural_interview.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4420250/normal_5fec51f632ab5.pdfIn PDF document text
- http://classkaod.ru/how_to_deal_with_a_power_struggle_at_workz7gb5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409114/normal_603fe08bbdf75.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477873/normal_5fd7fc392ecc7.pdfIn PDF document text
- http://taxafig.66ghz.com/3349001451.pdfIn PDF document text
- http://rugegav.mywebcommunity.org/13365541604.pdfIn PDF document text
- http://dithetsen.xyz/dulubosesekuwurufwplea.pdfIn PDF document text
- http://wijasagasipode.getenjoyment.net/thule_bike_rack_parts_canada.pdfIn PDF document text
- http://fallofelin.online/furovosisesezavadzd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4497685/normal_6013cb44bcfd5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://wusepobokajed.rf.gd/crud_php_mysql_template.pdfIn PDF document text
- https://e9593579-f51f-4dc6-af55-2543ab512b45.filesusr.com/ugd/37952c_bb6fc4a8ce5245e999cb0e0eb270c7c0.pdf?index=trueIn PDF document text
- https://98350ace-7ac4-4f38-a9d9-579fdad8050b.filesusr.com/ugd/9b2d9b_e84b30a1bf97408c867e06f44f98be2a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/56b54241-80f9-4b0b-9f0e-93d094fe5d0b/33344458440.pdfIn PDF document text
- https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_1619c48932b94360ab4acb18ac294bd3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/be9c7bf3-ba86-4cb4-8759-ca2ddd346c73/is_dr_berg_legit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/825ba1a5-d63f-4dbc-930a-02097e7eebb5/dokawarujasinurewizigu.pdfIn PDF document text
- https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_ddd1852537ce47e1ae08afd13e9c6026.pdf?index=trueIn PDF document text
- https://95049c82-e412-4913-a0b0-e03e83d5170a.filesusr.com/ugd/127d6e_c4dc894b60064914af2758ffd35dade6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/959383ae-089a-4a77-9124-19d7e7a8e258/63137282205.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e892.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE892 | 6052 bytes |
SHA-256: c86e8690efa9880f644ef7cdc5b114d6e7ae909cd880a6a4547d85304b24bf67 |
|||
font_01_sfnt_off0000fd29.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD29 | 11764 bytes |
SHA-256: 9148c9e87103bffa4ce4e463e833884d89ca28412b6a0b198737e0d0a8b2b758 |
|||
font_02_sfnt_off0001257e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1257E | 16204 bytes |
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.