MALICIOUS
144
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains heuristics indicating it is a phishing lure, specifically using an SEO redirector for a 'free-download' scam. The ML classifier strongly flagged it as malicious, and ClamAV detected it as a phishing trojan. The embedded URL, https://mezovuduw.ru/strik?utm_term=cl+racing+mini+manual, is the primary indicator of a malicious redirector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=cl+racing+mini+manual PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4b2db348-29e3-4e54-8c34-099c0621a833/93251238219.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72ca9d66-fdd3-4328-b152-9d35129ea7e9/15668576944.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7613f21-17f8-4704-8666-4d5bf13596b1/is_webull_better_than_etrade.pdfIn PDF document text
- https://s3.amazonaws.com/feliso/bus_map_florence.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e63a1787-7951-46c2-b659-0c7b9b812f79/how_to_cook_beans_in_power_pressure_cooker_xl.pdfIn PDF document text
- https://s3.amazonaws.com/remuv/8961088545.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b987d3f-a300-48aa-af29-ab40679c6c70/how_to_read_whirlpool_dishwasher_error_codes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/43086d53-b14d-46e9-8054-f3c95538d308/how_to_get_the_total_surface_area_of_a_rectangular_prism.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb99eb83-f1da-4924-8c25-5aae1d7fc96e/what_is_probability_theory_in_decision_making.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bea53916-4abd-450d-b374-3ecf83682cba/pinnacle_movie_maker_free_trial.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/499dab64-2fd8-4ebd-b114-0da14c9bea1d/asphalt_8_airborne_mod_apk_free_download_for_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e881693a-c9cf-4c0a-8e36-af9c746a33cd/tomuvolitiko.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/902d16e8-f07a-41e4-8cb9-323ff34fb97e/4202250300.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5c202b4e-7428-48fb-93b5-3aea1607dfc9/tipusiwosagez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/84f6c991-d045-4775-98a3-c3d6aca366fc/detijofemidujili.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3235279a-6391-4bde-9def-adf560c7e784/does_roomba_690_have_smart_mapping.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/226457da-15d5-4876-b90d-50704470297b/full_version_how_to_get_minecraft_windows_10_edition_for_free_2019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/991377f2-828d-497e-93d8-e9ef613223ea/repair_cracked_heat_exchanger_furnace.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/78a00e35-0c88-4a4b-8eef-02a027a098f8/how_to_reset_a_kenmore_washer_series_100.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1E1 | 4844 bytes |
SHA-256: f3f4434657b95f96b6052cd5f3eb1d022441c5517b509b1fdb89e4dbd844787a |
|||
font_01_sfnt_off0001023f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1023F | 11900 bytes |
SHA-256: 853627a182066a2986e9c92409f23d6b6ee4dcd835ab350786811d8bd7cf31c4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.