MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is identified as malicious by ClamAV with a critical heuristic firing for Pdf.Phishing.Trojan. The PDF contains numerous embedded URLs, with one heuristic specifically flagging it as a link farm on disposable hosting. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of multiple external links strongly suggests a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3403
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://naviway.su/upload/files/56943431513.pdf In PDF document text
- http://wuyioutdoor.com/userfiles/file/63337221912.pdfIn PDF document text
- http://audidalys.lt/ckfinder/userfiles/files/44225040696.pdfIn PDF document text
- https://alakharia.com/public_html/userfiles/file/51832445804.pdfIn PDF document text
- http://ristorantebiscione.com/userfiles/files/vurofuw.pdfIn PDF document text
- http://3gr-group.com/ci/userfiles/files/dimigoleponabumakekoka.pdfIn PDF document text
- http://siddharpeedam.org/userfiles/file/In PDF document text
- https://augsburger-dartliga.de/uploads/file/54929750905.pdfIn PDF document text
- http://bm-shower.com/userfiles/files/saxatejodijiwi.pdfIn PDF document text
- http://newtrichur.com/userfiles/file/6514003454.pdfIn PDF document text
- http://dxqzx.com/ckfinder/userfiles/files/20210903_214458.pdfIn PDF document text
- https://yukkumpulgroup2.com/contents/files/92992511517.pdfIn PDF document text
- https://ms01bet.com/contents/files/14670380895.pdfIn PDF document text
- https://shreenathtechnologies.com/userfiles/file/6677008294.pdfIn PDF document text
- http://seanmore.com/userData/board/file/21624167682.pdfIn PDF document text
- http://yongqingtech.com/d/files/lufefebikutexazibijasuka.pdfIn PDF document text
- https://durimawar.com/contents/files/11871319746.pdfIn PDF document text
- http://print-printonline.com/ckfinder/userfiles/files/52833587529.pdfIn PDF document text
- https://quasar.mago.ro/ckfinder/userfiles/files/27192558683.pdfIn PDF document text
- https://www.rapn.ru/ckfinder/userfiles/files/15893281566.pdfIn PDF document text
- https://amrapalispot.com/userfiles/file/76172136567.pdfIn PDF document text
- http://maidichike.com/upload/files/90352079025.pdfIn PDF document text
- https://www.nevjegykiraly.hu/userfiles/files/39530405471.pdfIn PDF document text
- https://aymsoft.us/aym_image/files/5218113066.pdfIn PDF document text
- http://infas.cz/images/wiswig/file/kijogivirisodox.pdfIn PDF document text
- https://invest.pl/userfiles/file/31219145632.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=anexion+de+centroamerica+a+mexico+pdfPDF link annotation
Open this report in the interactive analyzer, or submit your own file for analysis.