MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded URL 'https://fokemale.ru/award?keyword=functional+strength+training+for+australian+rules+football+pdf' is likely the primary lure, disguised as a relevant document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/award?keyword=functional+strength+training+for+australian+rules+football+pdf PDF link annotation
- http://budonap.iblogger.org/refrigeration_and_air_conditioning_nptel_notes.pdfIn PDF document text
- http://rirelavemug.iblogger.org/free_brochure_template_s_for_microsoft_word.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_3ced8e143c4d4d17bc90c92e052fd4e6.pdf?index=trueIn PDF document text
- https://9e9203d9-9f5b-42f2-a849-05e42d741f90.filesusr.com/ugd/3527d5_2cde8034cf0e466380cc7da968c98707.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3a90a93a-0211-4fb8-985d-71e5777a2ab0/movies_like_the_devil_wears_prada_reddit.pdfIn PDF document text
- https://e966359d-176b-477a-9ad9-c314bea94227.filesusr.com/ugd/fa6f14_0d709a06474b4d488d719328783d4102.pdf?index=trueIn PDF document text
- https://e012ec00-e8e8-475f-a96b-80cab2ad705b.filesusr.com/ugd/3f1139_97348af72aa8470abef58ee967483ed6.pdf?index=trueIn PDF document text
- https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_c5c6f4d31ba344d89f4b797b8650b17e.pdf?index=trueIn PDF document text
- https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_b6732b5361ad43babb99ebd9f79b0fd8.pdf?index=trueIn PDF document text
- https://95049c82-e412-4913-a0b0-e03e83d5170a.filesusr.com/ugd/127d6e_c5b60d3d699d4659a6eba5fce47da0d2.pdf?index=trueIn PDF document text
- https://d7b50aa0-fea3-4edc-ba9e-4ed0094b0c60.filesusr.com/ugd/7f614e_bf03a518638a437396163b3b2b5e10e1.pdf?index=trueIn PDF document text
- https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_af4492ac1ff0407f9ffd5801a1438f7e.pdf?index=trueIn PDF document text
- https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_5aa0ae2cb00c425cb6a32ddcfa92857a.pdf?index=trueIn PDF document text
- https://5071cc05-3fa2-46b1-b944-d2523ca4b51d.filesusr.com/ugd/62e2c1_37a3a35dd316476db8f0d895f7d6560e.pdf?index=trueIn PDF document text
- https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_d5011f8bd7fb41c1b6e0bcdff92db6f5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1509a296-096c-47ef-a74a-f78e4b20c4dc/39004220208.pdfIn PDF document text
- https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_3a32dca14a304ebbbd10899cb17c6a67.pdf?index=trueIn PDF document text
- http://luzosuvupe.rf.gd/24635239745.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000112eb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112EB | 5512 bytes |
SHA-256: 3a9f87c2290ccf0e92935af46250496bfe617d26278afe8353c09fd3ec08580a |
|||
font_01_sfnt_off0001259b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1259B | 11048 bytes |
SHA-256: 37c8aa42e49b0e974988ab8d5a8091a29fa3405d5a93660360d1996a9918c467 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.