MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier with high confidence. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or SEO manipulation tactic. One of the primary URLs extracted is 'https://leonvi.ru/wix?keyword=comparing+simple+and+compound+interest+worksheet+answers', which appears to be a lure for users interested in financial worksheets. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of numerous external links strongly indicates a malicious intent to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9985
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/wix?keyword=comparing+simple+and+compound+interest+worksheet+answers
- https://static.s123-cdn-static.com/uploads/4412582/normal_600529fdd9ebe.pdf
- http://50offshop.pro/lujesomiy4140.pdf
- https://cdn-cms.f-static.net/uploads/4481667/normal_60356c63494ad.pdf
- https://muxavitegujun.weebly.com/uploads/1/3/1/6/131637584/videl.pdf
- http://oneshops.space/vijapugazaxegolxkh9s.pdf
- https://pojekemo.weebly.com/uploads/1/3/4/4/134469054/fifuvowagim_fulol_fovorijexusajaj_tumalulupidifov.pdf
- https://nofuzibid.weebly.com/uploads/1/3/1/4/131453406/namowewobekuxikisof.pdf
- https://cdn.sqhk.co/betewulo/iigiGja/94537063180.pdf
- https://cdn.sqhk.co/nimotixalulo/giiZhfc/pukiguriwalo.pdf
- http://instgramcopyrightdispute.com/bowflex_treadclimber_tc1000_partsp25m1.pdf
- http://p-kavkaza.ru/49904601548guzr4.pdf
- https://cdn-cms.f-static.net/uploads/4496592/normal_6011120844a1d.pdf
- http://mamajan.space/xunibemeoyxws.pdf
- https://static.s123-cdn-static.com/uploads/4387562/normal_5fee47c732733.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_59d9292ad4dd4f60bfc4c2c1f0bb520d.pdf?index=true
- https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_434d71a49c874ae4b1f1cd28aab7a40d.pdf?index=true
- https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_bbf381c4ee0b481b8561fb6cc48a3b5f.pdf?index=true
- https://010f2e21-25ca-4560-806d-08cbbb7c7db1.filesusr.com/ugd/74a852_c25949645b0e4236853e5e95c638f3ed.pdf?index=true
- https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_843d734d9a264a38a2e7d04a6c4e8a76.pdf?index=true
- https://6a8c3f3f-5248-4e80-80e0-4bf2c04f72bc.filesusr.com/ugd/8b2c09_6213e52d568f4bcd8fe4bcb3956e4c21.pdf?index=true
- https://6e37e838-c278-4d46-baa9-25b8497af200.filesusr.com/ugd/fbcb80_d156c2f7dde64763bc23ecee2a242f6f.pdf?index=true
- https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_118e77f1b1c045aeaecc3e2e713fbc8c.pdf?index=true
- https://9fbaa0db-fe9e-443e-b503-3d02ea494c21.filesusr.com/ugd/d417e9_fa397ce2b8e944d0a0b7cc582ff000a0.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f5dc.bin85b692c1c636aed9ab1240d2a7361179fdd6c0849396a06064984f922e967b4f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5DC | 2828 bytes |
font_01_sfnt_off0000ffd6.bin0523482bb331b8e7209d3a2ce6c69c7ddf727610499a71a6a43c52b2bafe878d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFD6 | 5548 bytes |
font_02_sfnt_off00011293.bin37684c9be1a9de06e08c6df8341facf16245f7ce0dd3f2b8eede4aa76b29b17e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11293 | 10092 bytes |
font_03_sfnt_off000134db.bincd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x134DB | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.