MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by multiple heuristics, including a critical finding for linking to known malicious redirector infrastructure. The document contains a large number of embedded URLs, suggesting a link farm or phishing attempt. The presence of a malicious redirector URL indicates an attempt to direct users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/wix?keyword=garmin+vivoactive+hr+manual+download In PDF document text
- https://zuligaxexepe.weebly.com/uploads/1/3/0/7/130775912/lepevenapipixogojez.pdfIn PDF document text
- https://dawemewi.weebly.com/uploads/1/3/4/7/134747996/6634717.pdfIn PDF document text
- https://peziwotikiju.weebly.com/uploads/1/3/4/6/134602895/b6ebbd0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://ec5c17a1-061e-4a2c-a9e6-b3561ba71229.filesusr.com/ugd/299074_2d588d2b5df04497be56ac8e572174e1.pdf?index=trueIn PDF document text
- https://8a7e94d2-1b07-4399-8a7b-cfebf1eb419e.filesusr.com/ugd/e78b77_97c0210e890141cc86e1b37890f400b9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/padosumifubobo/tefepaturovojutixonixut.pdfIn PDF document text
- https://s3.amazonaws.com/nevovumowa/rogajopupezise.pdfIn PDF document text
- https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_9900f53afb7543db888067a3663956cc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fosalizuzu/kilomosuzanivono.pdfIn PDF document text
- https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_d0206990023f4e46b10b95d2312d87f8.pdf?index=trueIn PDF document text
- https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_4b4483aad2de4d0fb45dcdf99f366a6d.pdf?index=trueIn PDF document text
- https://0eaabcdb-938a-45a6-85a3-1a7d796bbcdd.filesusr.com/ugd/8d6d25_13eb83cc52c145e7bc14443b41c98bf0.pdf?index=trueIn PDF document text
- https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_f10b02b06b6c4eb88daa0899d8f0518d.pdf?index=trueIn PDF document text
- https://60659a61-a27b-47ea-8eac-a81775c62269.filesusr.com/ugd/7a7fb1_75d4371c2bac446c9344bb07dfea70ad.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ginutu/how_much_does_it_cost_to_start_a_car_dealership.pdfIn PDF document text
- https://dcd55a6f-f4d9-4ab7-9ea0-0dac4ffa5d6f.filesusr.com/ugd/f7cbe4_cef9a185274349ea9f7b92d6db40a3ea.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dobikasukavu/integral_of_sin2x_cos_x.pdfIn PDF document text
- https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_5d05e238556448ee9064a14351c6a500.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kukazowox/91408621632.pdfIn PDF document text
- https://0e01c86c-6ad9-43de-bc04-b8819f410213.filesusr.com/ugd/73c254_93991905f94c49a69d1b7efc262c761b.pdf?index=trueIn PDF document text
- https://2ed9768e-82a7-41f7-bc91-4b86d8d7aa0f.filesusr.com/ugd/bdbd91_ee7356a67bfb4eb4bb911e5482fdbdc3.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7c5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7C5 | 5184 bytes |
SHA-256: f6a37fa44d7c31d1e0cc34e0c29b4580e01aa768615d603262464db2e957465b |
|||
font_01_sfnt_off0000f953.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF953 | 11796 bytes |
SHA-256: 03de32c63a858a003a23c0863ca72f9fa4a53533d433ef0c109eac9bd1a2bd23 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.