MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. Heuristics indicate it functions as a link farm and a callback phishing lure, prompting users to call for support regarding billing or security issues. While no scripts were explicitly extracted, the presence of embedded URLs suggests a potential for further malicious activity or redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/wix?keyword=net+force+problems+worksheet+with+answers PDF link annotation
- http://nifazafagikoxa.medianewsonline.com/how_to_draw_a_thanksgiving_turkey_easy.pdfIn PDF document text
- http://movawizaxaxato.mywebcommunity.org/what_is_the_order_of_books_in_the_twilight_series.pdfIn PDF document text
- http://magicwoolshop.com/kleine_zeitung_ballguidevl2kv.pdfIn PDF document text
- http://bio-ita.fun/here_we_go_city_navigation_apko6x54.pdfIn PDF document text
- http://gudelew.mywebcommunity.org/adrenergic_drugs.pdfIn PDF document text
- http://refoxedij.iblogger.org/7478120670.pdfIn PDF document text
- http://xujaxul.mywebcommunity.org/7372139643.pdfIn PDF document text
- http://itclick.pro/stephen_king_it_1990p2vmh.pdfIn PDF document text
- http://jirenaxapibetig.scienceontheweb.net/a_voyage_long_and_strange_prezi.pdfIn PDF document text
- http://tedurelaseji.mygamesonline.org/vifoxu.pdfIn PDF document text
- http://kersita.space/foodservice_organizations_a_managerial_and_systems_approach_9th_editionh6c7t.pdfIn PDF document text
- http://vizionsmc.net/2652786287922fmh.pdfIn PDF document text
- http://soul-felt.com/229030523133gxvj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://dizibabazuvuxu.rf.gd/metformin_pcos_weight_loss_tips.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28cbc6eb-2970-4269-b128-a7a8cb9f562c/79870889842.pdfIn PDF document text
- http://sefowolo.atwebpages.com/anger_management_worksheets_for_10_year_olds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3be02fff-6cb8-4a1b-9828-b906d7cbfffc/56264640251.pdfIn PDF document text
- http://megigezorozo.atwebpages.com/pozevi.pdfIn PDF document text
- http://roveramo.atwebpages.com/miladetanadozigiwepubed.pdfIn PDF document text
- http://bojibag.epizy.com/what_is_a_verb_for_1st_grade.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3BE | 5520 bytes |
SHA-256: ec6dd2e3c284dd057a1632983f232731aba52e726b863495c8c1f9190f80d864 |
|||
font_01_sfnt_off0001066b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1066B | 11644 bytes |
SHA-256: f32fd0f9cc3703f6b9b3455d4a967072f2c8fe87edb866cbbdba16c281430167 |
|||
font_02_sfnt_off00012e88.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12E88 | 16140 bytes |
SHA-256: 5bfda07072dd2e1b0df7f1680a75ba616774ec51e1a09c257f000ba239241e1c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.