MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains numerous embedded URLs, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious content. The document body, though heavily obfuscated, appears to be a lure related to 'arduino cnc drawing machine pdf', likely to entice clicks on the embedded malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9010
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/award?keyword=arduino+cnc+drawing+machine+pdf PDF link annotation
- https://cdn.sqhk.co/marixefe/7hfidje/sivimemilezutadaw.pdfIn PDF document text
- https://cdn.sqhk.co/kejofuvata/tjjggZh/lapejakuwelejuvagalepilow.pdfIn PDF document text
- https://kifofudodor.weebly.com/uploads/1/3/4/8/134878181/lonede-porididisedij-vefilivufekosux-sofadapopuxi.pdfIn PDF document text
- https://cdn.sqhk.co/wiluxuko/jhgiEgh/college_football_playoff_national_championship_2020_tickets.pdfIn PDF document text
- http://gezilobogobig.22web.org/tekarinuwuvorepetode.pdfIn PDF document text
- https://jososipiwudamuw.weebly.com/uploads/1/3/2/7/132740918/997abac9f672.pdfIn PDF document text
- http://front-glass.space/sulitowaku6s7v8.pdfIn PDF document text
- https://notuvovezed.weebly.com/uploads/1/3/1/3/131382721/midotabaguzol_gozemidafef.pdfIn PDF document text
- http://xalowazejadiv.getenjoyment.net/radical_candor_free_download.pdfIn PDF document text
- https://cdn.sqhk.co/miseseren/blicjhw/galaxy_theatres_cannery_north_las_vegas_nv.pdfIn PDF document text
- http://adminhalil.com/a_mothers_reckoning_sue_klebold4i2zi.pdfIn PDF document text
- https://gusujosu.weebly.com/uploads/1/3/0/7/130775940/tusedono_rivozobu_pejunerijini.pdfIn PDF document text
- http://rasipafus.getenjoyment.net/best_wendler_5_3_1_app.pdfIn PDF document text
- http://nakidki-alkantara.xyz/how_to_play_sorry_fire_and_ice_instructionsxef4x.pdfIn PDF document text
- http://lulopoboxefon.scienceontheweb.net/asus_sabertooth_990fx_r2_0_manuale_italiano.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8d783d5-63d2-4bdf-9233-72398a4ca7bc/how_to_change_hp_deskjet_2652_ink.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55394951-76e0-44a3-ae98-75adc8d2fea3/36100466595.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2a90ed5-2885-452b-8919-9664a9218e15/wojigerenojofakefawukewox.pdfIn PDF document text
- http://livuladebugalab.rf.gd/rumi_poems_love_farsi.pdfIn PDF document text
- http://ligifufeg.rf.gd/nenawetuterogudikur.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad847ca0-41e3-4cb7-872c-2fd961286b47/buy_old_law_books_online.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.