MALICIOUS
126
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.9468
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yubit.co.za/XSRYdR1H?utm_term=fle15%2F+2%2F+r30xl PDF link annotation
- https://cbrn.tj/nrsa_system/ckeditor/kcfinder/upload/files/fivunedudil.pdfIn PDF document text
- https://tourpon.kr/FileData/ckfinder/files/20220221_DC19131C43978C3C.pdfIn PDF document text
- http://ceu-jgh.org/kcfinder/upload/files/roxatadofulu.pdfIn PDF document text
- http://aiswaryamatrimonials.com/fck_uploads/file/bidibiramexebepuwun.pdfIn PDF document text
- https://newshieldinsurance.com/demo/gsa/final/images/file/84217151355.pdfIn PDF document text
- http://vivatbacchus.hu/files/file/1942667013.pdfIn PDF document text
- http://koppeika.ru/userfiles/file/5529446610.pdfIn PDF document text
- https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/2591e228774db0eef0808815c8d1e8e6/xiguro.pdfIn PDF document text
- http://signexpowholesale.com/project-new/christianbook/upload_images/file/bugowotivorimajozegu.pdfIn PDF document text
- https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/i47jju7hgoicho7rq4jvlktibp/62891406800.pdfIn PDF document text
- https://varoslod.hu/kcfinder/upload/files/tunima.pdfIn PDF document text
- https://www.datacom.com.br/assets/admin/ckeditor/kcfinder/upload/files/25933347536.pdfIn PDF document text
- http://judemusic.nl/fckdata/file/rasufikuvoxakavidel.pdfIn PDF document text
- http://cbstav.cz/file/lubilelimizupiv.pdfIn PDF document text
- http://cachnhietcacham.vn/Images_upload/files/wejuwoxojodivajor.pdfIn PDF document text
- http://gaia-onlus.org/userfiles/file/lisupogoduveb.pdfIn PDF document text
- http://n-production.com/upload/fckeditor/file/nunegegu.pdfIn PDF document text
- http://omonetach.pl/foto/ilustracje/file/disiwekikidutex.pdfIn PDF document text
- https://intrastorg.com/userfiles/file/velodatizefikimiwa.pdfIn PDF document text
- http://cainghienbinhduong.com/uploads/userfiles/file/42294088848.pdfIn PDF document text
- https://triplejfoundation.com/nbloom/fckuploads/file/batawor.pdfIn PDF document text
- https://evrenmentese.com/upload/ckfinder/files/jimedomibawokedokisawagak.pdfIn PDF document text
- http://akgwealthplanner.com/crm/files/93395436485.pdfIn PDF document text
- http://96rangjai.com/userfiles/file/xoguna.pdfIn PDF document text
- http://ayurvedabodycure.com/kcfinder/upload/files/zebotanorelusovow.pdfIn PDF document text
- http://keemunblacktea.cn/uploads/file/050420404909.pdfIn PDF document text
- https://www.akita-tourism.com/assets/admin/plugins/kcfinder/files/lejelolaredirobera.pdfIn PDF document text
- http://4yoga.by/pics/files/gonewowenifibarufixub.pdfIn PDF document text
- http://chafewyuok.handysociality.com/upload/files/28942710010.pdfIn PDF document text
- http://veterinariacomportamentale.it/userfiles/files/bowifewivugukumujakoxaze.pdfIn PDF document text
- http://www.rbn.org.np/public/admin/plugin/kcfinder/upload/files/dosiganuputube.pdfIn PDF document text
- http://manchetenewsms.com.br/ckfinder/userfiles/files/xosus.pdfIn PDF document text
- https://posaonakosovu.com/ckfinder/userfiles/files/86219182697.pdfIn PDF document text
- https://imapcb.org/wp-content/plugins/super-forms/uploads/php/files/df091570275becee379409e8fbc54b7d/91907847538.pdfIn PDF document text
- http://photo-preiss.com/upload_files/files/munabofuwaguka.pdfIn PDF document text
- http://vxclouds.com/userfiles/file/jugedozalixugig.pdfIn PDF document text
- http://kimhoatra.vn/upload/fckimagesfile/66157461618.pdfIn PDF document text
- http://safakkereste.com/kcfinder/upload/files/11324872677.pdfIn PDF document text
- http://xn--12cm8caae5d9a0a0a1dxk6dd.com/user_img/files/nalapenotiwadenovuwako.pdfIn PDF document text
- http://behtarinekhodetbash.com/files/files/45373511695.pdfIn PDF document text
- http://helppakistan.nl/cmsimages/file/22985297311.pdfIn PDF document text
- http://safiorida.nl/operatori/userfiles/file/88634693796.pdfIn PDF document text
- http://simonova-zahrada.cz/ckeditor/kcfinder/upload/files/zitogexopex.pdfIn PDF document text
- http://kronikarp.pl/ckfinder/userfiles/files/54312114435.pdfIn PDF document text
- https://angkaganjil.com/contents/files/81016902127.pdfIn PDF document text
- http://www.sgpm.krakow.pl/aanewsysn/kcfinder/upload/files/84922186599.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
+5 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001c73a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1C73A | 17472 bytes |
SHA-256: 982f07872aef1db1d4e2cae90549e0d3cbed66dcc85431fa4aca7913a00ad840 |
|||
font_01_sfnt_off0001f51c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1F51C | 10068 bytes |
SHA-256: 0639d9c4bcffa0922f86e41b9316144e56404a3c6a35196ea9b7fc8e73b90825 |
|||
font_02_sfnt_off00020bce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x20BCE | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.