MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF is identified as a phishing lure due to its image-only nature and a click-outward action. It contains numerous external links, with one prominent URL pointing to 'baarspo.ru'. The ClamAV detection and ML classifier further support its malicious classification, indicating it likely serves as a dropper or phishing page.
Machine Learning
- Nyx PDF Classifier malicious score 0.8343
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/aws?utm_term=did+thoth+exist
- https://cdn.sqhk.co/nozedimasav/4Ngfjam/hello_bello_body_wash.pdf
- http://sexutepunoronuw.iblogger.org/windows_7_iso_microsoft_trial.pdf
- https://cdn.sqhk.co/vumojakizaw/ii8Cgc2/democracy_in_america_today_podcast.pdf
- http://zezomaxijuduj.22web.org/thames_water_assistance_fund_application_form.pdf
- https://cdn.sqhk.co/wanoposuj/ijcjc1B/zitij.pdf
- https://cdn.sqhk.co/dorejewibiz/B0ig1ie/why_is_final_fantasy_tactics_not_on_ps4.pdf
- https://7ae52be2-ba3c-41fb-8935-29281088223e.filesusr.com/ugd/affaa6_3820bf414d4f4323b0e75c7fec0b85e5.pdf?index=true
- https://uploads.strikinglycdn.com/files/bc34dc2a-ab10-4fb2-b1b5-cc86af42e320/unix_commands_cheat_sheet_2019.pdf
- http://mupevisad.epizy.com/interstitial_lung_disease_management_guidelines.pdf
- https://uploads.strikinglycdn.com/files/aa9a7578-78d6-4c2a-9624-2fc76b23d3bf/william_shakespeare_famous_poems_sonnet_18.pdf
- https://98cdd5c5-c43e-49eb-9373-39517e896cbb.filesusr.com/ugd/90661f_0d5e9d48c85442ef95172efa6982b340.pdf?index=true
- https://uploads.strikinglycdn.com/files/8bc34192-d217-4e61-94fe-cff9d35f1d4e/71622034425.pdf
- https://uploads.strikinglycdn.com/files/01f7de91-a42b-4574-b79c-56dd1a3306c1/tenadokogow.pdf
- https://76c9fb28-c10e-4950-85be-37de24a2ede8.filesusr.com/ugd/fa32a6_df9bf34906d84c42a9e009c898d791de.pdf?index=true
- https://d0aee4dd-c5bf-4c29-adcf-3aa844f59ef3.filesusr.com/ugd/193d13_b771cf6701034c4ba7f2e94dd6a45866.pdf?index=true
- https://uploads.strikinglycdn.com/files/b0800092-8e65-4c4d-ad88-b77d9e6b1ced/how_do_i_turn_off_auto_answer_on_panasonic.pdf
- http://fokexup.rf.gd/todobopowuwegofagodegojif.pdf
- https://uploads.strikinglycdn.com/files/5ea7fd5f-e97f-4edf-bc24-734ba20f10c2/how_to_program_directv_remote_rc73_to_samsung_smart_tv.pdf
- https://uploads.strikinglycdn.com/files/ed4d089f-69a7-4ef3-b692-5b98cad03523/que_es_propuestas_de_intervencin_educativa.pdf
- https://76bf42c0-7447-45ed-8dd3-33f9786ae3ae.filesusr.com/ugd/ba2c19_e71c959bedab4c40aca31b2078097452.pdf?index=true
- https://uploads.strikinglycdn.com/files/7a19fb43-6250-4877-ae04-220f35e7279b/suwamejizubaxilutab.pdf
- https://uploads.strikinglycdn.com/files/df6df903-81ba-4152-969f-4916b74f73f8/can_you_do_an_image_search_on_iphone.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.