MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded URLs, with at least one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and the ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'formulas in excel sheet', suggesting a potential lure related to document manipulation or data extraction, leading to the malicious URLs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/award?keyword=formulas+in+excel+sheet+pdf In PDF document text
- http://zumewidife.mygamesonline.org/misonirakusufowikagefel.pdfIn PDF document text
- https://cdn.sqhk.co/nadipozow/i1gerz6/1217613885.pdfIn PDF document text
- https://cdn.sqhk.co/lolajelor/hjGQHhf/lisa_fruitman_dentistry_prof._corp.pdfIn PDF document text
- http://jafebidit.getenjoyment.net/karya_tulis_ilmiah_tentang_bahaya_merokok.pdfIn PDF document text
- https://cdn.sqhk.co/kosibowo/yicjerp/2020_election_ballot_questions_virginia.pdfIn PDF document text
- http://fuzubijixulux.mygamesonline.org/41981104913.pdfIn PDF document text
- http://xorimomupajo.scienceontheweb.net/wubazaxugemat.pdfIn PDF document text
- https://cdn.sqhk.co/rixutixim/hhD71ib/mi_launcher_apk_free_download.pdfIn PDF document text
- https://cdn.sqhk.co/vujenibolo/Ujihbhg/jopegoviselabinivikafufi.pdfIn PDF document text
- http://kidufamipowanot.mywebcommunity.org/tax_residency_certificate_usa.pdfIn PDF document text
- http://taforojujutusig.mygamesonline.org/xogelufokiniriviwe.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/67a2d886-05dc-4305-94d3-32c7397c6a0a/fobuwunejotufezamovugen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/061ffe46-7bfe-4cc8-a94c-9e814fdd09ac/21377776555.pdfIn PDF document text
- https://c3373aeb-ed74-4f2d-b631-fa679e0a3f6f.filesusr.com/ugd/cbe7f7_41239e597af84215a88ca50f5d21d858.pdf?index=trueIn PDF document text
- http://duvodix.myartsonline.com/niriwojisuzojixepuf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c820525-c7ee-423c-b6b7-ee543f6ede7b/logitech_z623_2.1_channel_speaker_system.pdfIn PDF document text
- http://sitafefisoju.atwebpages.com/can_police_see_your_snapchat_memories.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f87b1b9f-d399-4dbb-bbbb-8ee842e834ea/90733204387.pdfIn PDF document text
- https://0c7b1e5d-10e9-4c66-9a64-57e6babc74f3.filesusr.com/ugd/6b59ba_51d1821f54e44c6b88bb7281f6c78cf2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ed1d620a-324c-45e7-b064-c3dd8f6d7fb0/can_you_play_baldurs_gate_dark_alliance_on_xbox_one.pdfIn PDF document text
- https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_df812baba3c34572a3b3c600c547576f.pdf?index=trueIn PDF document text
- https://d848e4b6-662b-4424-a759-963270729452.filesusr.com/ugd/30e015_94775776118c42a1866aaa0964224f98.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea19.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA19 | 5416 bytes |
SHA-256: 4f3fdc733b6b00b0e86008c18542cfd656ab077a4dfc91fe1b75bb95cff884c5 |
|||
font_01_sfnt_off0000fc5e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC5E | 12644 bytes |
SHA-256: 06ddd1d812a9bca9c27ad85b5bdc06978cf205a678fa9e2f6508fcb770fdefd2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.