MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://yafferge.ru/strik?utm_term=10.s%25C4%25B1n%25C4%25B1f+matematik+konu+anlat%25C4%25B1m+pdf', is the primary indicator of malicious intent. While no scripts were explicitly extracted, the ML classifier and ClamAV detection strongly suggest malicious content, likely a phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/strik?utm_term=10.s%25C4%25B1n%25C4%25B1f+matematik+konu+anlat%25C4%25B1m+pdf
- https://cdn-cms.f-static.net/uploads/4417413/normal_6056c12125437.pdf
- https://cdn-cms.f-static.net/uploads/4451356/normal_602ca4c682142.pdf
- https://cdn-cms.f-static.net/uploads/4486534/normal_6022679c3e9bc.pdf
- https://cdn-cms.f-static.net/uploads/4369911/normal_5fd76d50c037f.pdf
- https://cdn-cms.f-static.net/uploads/4371799/normal_6061af480d931.pdf
- https://static.s123-cdn-static.com/uploads/4409417/normal_5feb6d276fb36.pdf
- https://cdn-cms.f-static.net/uploads/4419851/normal_6021f6db098ee.pdf
- https://static.s123-cdn-static.com/uploads/4385014/normal_5ffbb7f6e3c71.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/20ba12bb-c74f-4625-8e78-365b3d6d954d/62990641945.pdf
- https://uploads.strikinglycdn.com/files/cafa89c3-8f0c-47f9-8581-dc6538faa42a/titixakenotulazirokufob.pdf
- https://uploads.strikinglycdn.com/files/59fc5e6e-89e8-4835-a5f7-57ab86ea589d/70928567277.pdf
- https://uploads.strikinglycdn.com/files/9e33b146-4ef6-4c53-98a3-d450a06a354d/3021181182.pdf
- https://uploads.strikinglycdn.com/files/ffb52b65-e97f-483d-8ed6-2c987b5df1a2/6-5_rhombi_and_squares_answers.pdf
- https://uploads.strikinglycdn.com/files/fd61111a-9bee-4aac-93fc-4fa57a88d6ec/which_singer_sewing_machine_is_best_for_quilting.pdf
- https://uploads.strikinglycdn.com/files/950ee5fd-01ea-4eaf-9615-4bfaa05f446d/jubimivexubavegekalaf.pdf
- https://uploads.strikinglycdn.com/files/4d13bf34-0fe9-430b-bf8f-19a6e34a3987/why_is_my_amp_power_light_blinking.pdf
- https://uploads.strikinglycdn.com/files/501e2f35-9a05-46c0-8159-ff035f5ac048/85093008234.pdf
- https://uploads.strikinglycdn.com/files/46aacd68-628f-4960-8333-a12e2d0ed879/cual_es_la_formula_para_calcular_el_volumen_del_prisma_decagonal.pdf
- https://uploads.strikinglycdn.com/files/e7828552-1baf-4660-b118-da772230e6a5/how_to_program_ge_15142_digital_timer.pdf
- https://uploads.strikinglycdn.com/files/6a6e0c9e-a7fa-4272-a3ae-e97159d366eb/60186504311.pdf
- https://uploads.strikinglycdn.com/files/a0f1081f-c558-46fa-bed0-8d4c81ffa3d0/63008951768.pdf
- https://uploads.strikinglycdn.com/files/5d3374c1-908d-4f8e-99f8-be77ad103e4b/voxadigabusur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d678.bin94d85f7231a647800bdc3226a447bfba186ba5427891b55d6b99713ba75c001e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD678 | 5316 bytes |
font_01_sfnt_off0000e88b.bin3b578f23b4ef16ced81868069f261ec9700e28991786521bd5ccb0e3def343ab |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE88B | 12200 bytes |
font_02_sfnt_off00010ef2.bin6b08f8481c6c57ebf8f14ebfc3cac4dd00d3a39203628dd640d3b2d2ca935c04 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EF2 | 16140 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.