MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains heuristics indicating it is a phishing document, specifically using an image lure to redirect users to a malicious URL. The ML classifier and ClamAV detection strongly support this assessment. The embedded URL leads to a domain associated with phishing, likely attempting to trick users into providing credentials or downloading further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/award?keyword=b+pharm+1st+year+syllabus+2020+pdf PDF link annotation
- http://zuduwamani.mypressonline.com/kewavexixujuzobefezaxato.pdfIn PDF document text
- https://s3.amazonaws.com/kizugokofo/cardioversion_farmacologica.pdfIn PDF document text
- https://s3.amazonaws.com/mipeboro/fobofiwefirarufof.pdfIn PDF document text
- https://s3.amazonaws.com/xirixepo/real_survival_battle_royale_squad_mobile_apk.pdfIn PDF document text
- https://s3.amazonaws.com/lorugipopuxe/learning_java_programming_with_eclipse.pdfIn PDF document text
- https://cdn.sqhk.co/rujiwujik/QljbgfY/fast_key_launcher_app_download.pdfIn PDF document text
- https://s3.amazonaws.com/lowuwofuxali/is_it_healthy_to_use_a_diffuser.pdfIn PDF document text
- https://cdn.sqhk.co/makekajet/hhgZHgb/rubube.pdfIn PDF document text
- https://s3.amazonaws.com/gagotaniwipure/free_gantt_project_planner_template.pdfIn PDF document text
- https://s3.amazonaws.com/limewub/biblical_meaning_of_numbers_1-_1000.pdfIn PDF document text
- https://cdn.sqhk.co/visukodo/iigfIib/84262054737.pdfIn PDF document text
- http://mamubisuk.mypressonline.com/gosewigofudiwus.pdfIn PDF document text
- https://cdn.sqhk.co/kavatupopum/jfiaaie/armaan_malik_new_tamil_songs.pdfIn PDF document text
- http://femonejigajape.mywebcommunity.org/was_the_book_of_enoch_in_the_original_canon.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/769e671a-77ea-44b0-8cc4-ccc139be2975/poluxurokuperivawufi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/03de0544-0674-4bd2-90d1-195f6a44cee7/columbus_blue_jackets_schedule_printable.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d23775e3-36f7-4722-90c2-2213a3c39681/rofelavemijixajofudok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48b4ca1c-1012-4c6f-a986-c94eb92977c3/3396013004.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa49f477-2d83-424d-bb4c-b94308e764ed/komagolojavimisetetibule.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64323764-0557-4917-81fe-ce9bd20ade1f/schlage_camelot_entry_door_handle_installation.pdfIn PDF document text
- http://todiwefexoneb.atwebpages.com/kixin.pdfIn PDF document text
- http://fijorolur.myartsonline.com/public_speaking_coaching_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cece14cf-e1ff-4c5c-b986-990cbab16cd6/problemas_ambientales_en_mexico_2020.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012921.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12921 | 5900 bytes |
SHA-256: 598fae1ed3191290580bc94c1d3fdbf730d0adb742cdda6a9ce3f21d0d7eb410 |
|||
font_01_sfnt_off00013d11.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13D11 | 11504 bytes |
SHA-256: 13f5ef0b2550c3bad1aadf69f4b0205fe72ea31ba8c60e2c72fa3ee63f745e36 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.