MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm designed to distribute malware or conduct phishing. The primary malicious URL identified is https://mezovuduw.ru/award?keyword=bowflex+max+trainer+m5+manual+pdf, which is likely used to redirect users to a malicious site. The PDF structure itself, combined with the numerous external links, suggests it is used as a lure to exploit users.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/award?keyword=bowflex+max+trainer+m5+manual+pdf PDF link annotation
- http://rodsfish.club/sifegulenumepomasxq5fs.pdfIn PDF document text
- http://voyazh-shina.com/vupojuwirojivep3i4w.pdfIn PDF document text
- http://legko.travel/sansa_4gb_mp3_player_manualyvq06.pdfIn PDF document text
- http://astrology-personal.online/mukewey981.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://abee6ad4-cf47-459a-954e-22b9b9bb30ad.filesusr.com/ugd/4bdc6d_6811c371b3fd4289a37cac0f713be9b9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sifawekujiki/gamutobixup.pdfIn PDF document text
- https://s3.amazonaws.com/xebuvuwov/47716141388.pdfIn PDF document text
- https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_2e445fae351243eaab707df4300c42a5.pdf?index=trueIn PDF document text
- https://121f8fc1-d270-4171-a721-8ccd656fc20f.filesusr.com/ugd/2ca22b_6a808062d2a6474aaa37a946cf236d2f.pdf?index=trueIn PDF document text
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_c05182c28f1a4da69090549c2cb5aa0b.pdf?index=trueIn PDF document text
- https://7a1f2a0d-094a-4466-88af-72a4af93b9fa.filesusr.com/ugd/22739b_ea24dac069b34deb9d008ee96c5681bf.pdf?index=trueIn PDF document text
- https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_5b7fbdf4e2e44f93ab19e48883def686.pdf?index=trueIn PDF document text
- https://9e269ae7-c3cf-4b9f-bde2-1d9be064b7bf.filesusr.com/ugd/139869_6cd10ed87af449d6af3ebee6e2adf9b1.pdf?index=trueIn PDF document text
- https://87b84290-c0b3-4c73-97a1-3d59c64c3f69.filesusr.com/ugd/c638b7_9307cfa809a742e59be2d63050889a52.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tuzamada/offshore_fishing_report_daytona_beach.pdfIn PDF document text
- https://87d5e434-dc39-4d64-8681-877d64e204d5.filesusr.com/ugd/5660ac_0c335f2ac20c4e63a1a6f253b26095b6.pdf?index=trueIn PDF document text
- https://ffb80149-315c-4936-8637-e87477b606fc.filesusr.com/ugd/e7410d_08d25d7ba44640a0a51b93cdfaabec73.pdf?index=trueIn PDF document text
- https://1a441fb4-51dd-4528-a053-eb59ff664e18.filesusr.com/ugd/43d9d5_31dfa4aca4664d438870c4483b52b596.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pewibim/odia_new_film_jogi_all_song.pdfIn PDF document text
- https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_21cd8a4aeb87403b89276e929f0c5495.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/difigomisosak/hatchery_mod_breeding_guide.pdfIn PDF document text
- https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_7a955f744d374659bc7fa73f5c77fd49.pdf?index=trueIn PDF document text
- https://c538924d-9290-4e35-808b-5013ecaac822.filesusr.com/ugd/047ea9_ad53f868f3bb4c17a2d14ce8affbe46a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001010f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1010F | 5344 bytes |
SHA-256: e75f0ad16378f4a28278d276ae7cf3276afc41f132d769916a134b5264855e04 |
|||
font_01_sfnt_off00011341.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11341 | 11936 bytes |
SHA-256: 0c9515970d81edd66417278860838e37119f758c1b6f3e1acc5d034171a6daf7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.