MALICIOUS
106
Risk Score
Machine Learning
- Nyx PDF Classifier suspicious score 0.4159
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yubit.co.za/XSRYdR1H?utm_term=constructivism+in+international+relations+pdf+free+pdf+free PDF link annotation
- https://bevereka.weebly.com/uploads/1/3/0/7/130739533/6a8563fb37.pdfIn PDF document text
- https://litojufuzudefi.weebly.com/uploads/1/4/1/5/141535306/b91e04d68015.pdfIn PDF document text
- http://sevenseahotel.com/uploads/images/files/lobazojonel.pdfIn PDF document text
- http://megalabsrl.it/userfiles/files/82138369524.pdfIn PDF document text
- https://judexibegajojid.weebly.com/uploads/1/3/4/8/134885636/604947.pdfIn PDF document text
- http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1626169c7aafee---33677532574.pdfIn PDF document text
- https://togezajotutev.weebly.com/uploads/1/3/0/8/130874352/memunokojiduvorasa.pdfIn PDF document text
- https://suwutijotelites.weebly.com/uploads/1/3/6/0/136083726/bewubos_memimifuvodud.pdfIn PDF document text
- http://3wsystems.com/shipinc/userfiles/files/61006667668.pdfIn PDF document text
- http://ridonhennet.eu/admin/kcfinder/upload/files/tifekijakovakujexu.pdfIn PDF document text
- https://saksisan.com/upload/ckfinder/files/liwati.pdfIn PDF document text
- https://adporly.emailingmanager.com/uploads/editor/file/78327661727.pdfIn PDF document text
- http://lacasedescaraibes.fr/file/tufokutosuxe.pdfIn PDF document text
- https://www.yildiztto.com/kcfinder/upload/files/21507382945.pdfIn PDF document text
- https://vifexaxelis.weebly.com/uploads/1/3/4/4/134482988/7acd0dcde.pdfIn PDF document text
- http://cpils.com/userfiles/file/marobiki.pdfIn PDF document text
- http://mot-a-mot.fr/kcfinder/upload/files/disususa.pdfIn PDF document text
- https://fondation-irene.lu/files/files/disijuzu.pdfIn PDF document text
- https://dycmc.com/DATA/upload/files/202203200229162635.pdfIn PDF document text
- http://sampoernastrategic.com/uploads/image/files/82082764533.pdfIn PDF document text
- https://noxaboke.weebly.com/uploads/1/3/4/7/134701707/rufapewemofix_pelul.pdfIn PDF document text
- https://lushmark.com/editor_upload/file/73513136967.pdfIn PDF document text
- https://vudovonijojor.weebly.com/uploads/1/3/1/4/131437364/3718984.pdfIn PDF document text
- https://marketlayer.com/assets/kcfinder/upload/files/39081117846.pdfIn PDF document text
- http://pajurioverslas.lt/ckfinder/userfiles/files/xavukerewafaxum.pdfIn PDF document text
- https://chambredhotes-savoie.com/ckfinder/userfiles/files/59837860673.pdfIn PDF document text
- https://copab.tn/216mag.svn/uploads/files/337895576.pdfIn PDF document text
- https://247christianity.org/fckeditor/userfiles/file/jixunoterewijotosazigelo1643914067.pdfIn PDF document text
- http://sjatupornservices.com/file_media/file_image/file/tewurisakobinawe.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16268be1994b66---21221939141.pdfIn PDF document text
- https://lewotelifegi.weebly.com/uploads/1/4/1/3/141351467/7941069.pdfIn PDF document text
- https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/j56vjgjtss3n95stvi9a9to7j3/nojepegaraxatixotefa.pdfIn PDF document text
- http://www.tramag.pl/upload/file/tisopofigigejelases.pdfIn PDF document text
- https://handmade.sdelaemlegko.ru/files/userfiles/files/jasevopefivonewovilaf.pdfIn PDF document text
- https://gorimulokubev.weebly.com/uploads/1/3/1/4/131438265/xumakegofuforoje.pdfIn PDF document text
- http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/1622bc4b3a0ffb---jedukipugazilanebu.pdfIn PDF document text
- https://dichvuhappyhouse.com/upload/files/21047317514.pdfIn PDF document text
- https://vomediwanuxorat.weebly.com/uploads/1/3/4/3/134327005/napukenegixifa.pdfIn PDF document text
- https://zizuvikugit.weebly.com/uploads/1/3/1/3/131384696/2175892.pdfIn PDF document text
- https://midlanddevelopers.com/backend/web/kcfinder/upload/files/nefevuva.pdfIn PDF document text
- https://argentinaproduct.com/ckfinder/userfiles/files/pizomuluwobu.pdfIn PDF document text
- https://kogefekuso.weebly.com/uploads/1/4/1/4/141418607/bozatamepi.pdfIn PDF document text
- https://interativacorretora.com/fotosempresa/files/91388310466.pdfIn PDF document text
- http://chinahongji.com/d/files/gasenilawubupa.pdfIn PDF document text
- https://verdadeon.com.br/kcfinder/upload/files/rowadafon.pdfIn PDF document text
- https://kpk.1c.ru/admin/rc/ckeditor/kcfinder/upload/files/kajatelufirudiwufuve.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
+5 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0008aedf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8AEDF | 10976 bytes |
SHA-256: 616377f3d3afbc37b2a65acdc3536ac5a3de75f9895a6e29de9a98e113587a6e |
|||
font_01_sfnt_off0008c865.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8C865 | 16864 bytes |
SHA-256: 01ea66717f6ca09c1cf21e9b539d3e7bc5669dd0e6233a0a42922de1222ed08b |
|||
font_02_sfnt_off0008f3ea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8F3EA | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.