MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many of which point to domains associated with link farms and SEO spam. The primary embedded URL, 'https://dafemum.ru/award?keyword=emerald+tablets+of+thoth+pdf+download', suggests a lure to download content related to 'Emerald tablets of Thoth'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for distributing further malware or phishing content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9793
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/award?keyword=emerald+tablets+of+thoth+pdf+download
- https://wojulifurezusek.weebly.com/uploads/1/3/1/4/131438898/motefenedaposev.pdf
- http://vittorguxx.site/mango_street_book_online15yqe.pdf
- https://muzufuwuvul.weebly.com/uploads/1/3/2/3/132302955/8032840.pdf
- https://zediruli.weebly.com/uploads/1/3/4/7/134725524/9607728.pdf
- http://watercart.ru/87840176713g6j0b.pdf
- https://lajexupizad.weebly.com/uploads/1/3/0/7/130775806/7066535.pdf
- https://juxibawazorar.weebly.com/uploads/1/3/3/9/133997202/8360963.pdf
- https://gonufefimexej.weebly.com/uploads/1/3/4/8/134892828/junulema_vezuxo_vanadabamo_setogito.pdf
- http://fastgetme.online/how_to_update_sims_3_game_launcheru5d0e.pdf
- http://leadtop.co/power_book_2_ghost_episode_1118stww.pdf
- http://fibakigefejep.66ghz.com/gufaxaxevituluma.pdf
- https://pafebexazare.weebly.com/uploads/1/3/1/1/131163914/1269103.pdf
- http://stnold.com/death_note_characters_long_hairm9apa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/9764acbf-314d-4ce5-915b-073d13b82a44/pretty_little_liars_reboot_original_sin.pdf
- https://48e4e0df-78ce-4736-8797-27735e68dc67.filesusr.com/ugd/f3b179_2d1db8830b8847a99f7beb9fdf57cd22.pdf?index=true
- https://uploads.strikinglycdn.com/files/8db98ffb-b0b2-4eb6-b731-067287378b99/jajevuwokozaxorame.pdf
- https://uploads.strikinglycdn.com/files/047ebaec-c4dc-42b9-bbf8-490683fb3241/how_to_reset_my_weight_watchers_points_plus_calculator.pdf
- http://semerobaragizeg.epizy.com/38093489536.pdf
- https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_b01fc6be7c9c407bbc53d7106c52cc50.pdf?index=true
- http://zozadugaweguj.epizy.com/liwovanu.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c49f.bin392fc1a35a5ca4c19681bc5db3a5ee4e062f01e9c7e3167d04a330d3a90e8a57 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC49F | 5468 bytes |
font_01_sfnt_off0000d712.bin517ee6b96f886fa2b42cfb8daa3a4e0b6f457905f5934e5259005bd4aec557e2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD712 | 11972 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.