MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains multiple embedded URLs, with one specifically pointing to a domain that appears to be hosting malicious content related to a fake conversion tool. The heuristic firings indicate that this PDF is part of a link farm on disposable hosting, and ClamAV detected it as a phishing trojan. The ML classifier also flagged it as malicious, suggesting it's designed to redirect users to malicious sites for further exploitation.
Machine Learning
- Nyx PDF Classifier malicious score 0.6079
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/award?keyword=base64+to+pdf+conversion+in+java PDF link annotation
- https://s3.amazonaws.com/loneminovu/xopofibamokek.pdfIn PDF document text
- https://cdn.sqhk.co/zudilubal/WKODCSf/nowesupositisanuwedojepo.pdfIn PDF document text
- https://s3.amazonaws.com/remuv/craftsman_electric_chainsaw_blade.pdfIn PDF document text
- http://legionmone.xyz/labirent_3_indir_trke_dublaj0atqt.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4422620/normal_6000b5594756e.pdfIn PDF document text
- https://dexajaxalujum.weebly.com/uploads/1/3/1/8/131857565/xesetuzagujesad_gazuxonewi_zazidub_sokemuw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459784/normal_60117a2ec50bf.pdfIn PDF document text
- https://s3.amazonaws.com/garorowa/41139312468.pdfIn PDF document text
- http://olymp-trade.top/jeu_de_carte_a_2_avec_32_cartesqxr90.pdfIn PDF document text
- http://cardioactiveufficiale.site/barbie_unicorn_pet_doctor_ukdukqm.pdfIn PDF document text
- https://wonikisemuk.weebly.com/uploads/1/3/4/9/134902350/tufobifidexafafe.pdfIn PDF document text
- https://s3.amazonaws.com/zopenave/87597421386.pdfIn PDF document text
- http://granitmetrospecstroy.ru/dipetemagx14d.pdfIn PDF document text
- https://zupikadi.weebly.com/uploads/1/3/4/6/134667234/7330024.pdfIn PDF document text
- https://cdn.sqhk.co/puxedimuwo/xNxifig/sakupekoranubotefukoxew.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382779/normal_5fd3ba1651678.pdfIn PDF document text
- https://s3.amazonaws.com/mogipegi/loctite_glass_glue_data_sheet.pdfIn PDF document text
- http://nubolutlion.xyz/970367514939lbqx.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502500/normal_604cd6535b301.pdfIn PDF document text
- https://cdn.sqhk.co/baxoladipezu/OYjdBjg/u_v_box_reviews.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409797/normal_6044a07f80274.pdfIn PDF document text
- https://tavadarikozo.weebly.com/uploads/1/3/5/9/135987174/4cb2c6d0.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.