MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. The primary URL, 'https://kuzutuzo.ru/strik?utm_term=is+quickscreen+at+home+drug+test+reliable', is presented as a search result for a drug test query, a common lure for phishing. While no scripts were directly extracted, the PDF structure and numerous external links strongly indicate malicious intent, likely for initial access via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=is+quickscreen+at+home+drug+test+reliable PDF link annotation
- https://static.s123-cdn-static.com/uploads/4405430/normal_5fe5b92513c57.pdfIn PDF document text
- http://xukejufivakege.iblogger.org/34972081590.pdfIn PDF document text
- https://pixavegabub.weebly.com/uploads/1/3/5/3/135307945/vatojopur_pazefomid.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475738/normal_5fe32bd19657d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470016/normal_5fcb03b064fd2.pdfIn PDF document text
- https://resevaguwitim.weebly.com/uploads/1/3/5/2/135298688/suketobom.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367290/normal_5fd2c4f0a7474.pdfIn PDF document text
- https://reguzuseja.weebly.com/uploads/1/3/2/6/132695615/9670345.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://bobupugarini.epizy.com/browsec_extension_for_google_chrome.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5700b397-52a4-47aa-950b-0aa7f4c94446/wodase.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30d99600-8858-4cd7-9f13-42413ecc808d/cyberpunk_2077_ps4_graphics_settings_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8964f4cb-61e6-4c6b-a7a0-e48f54a4d791/69031030027.pdfIn PDF document text
- http://ratazudawi.epizy.com/hongkong_land_holdings_annual_report_2017.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2fe525f3-cadc-47ed-a4db-57e73b740ea0/41760094203.pdfIn PDF document text
- http://jazarinagirijad.rf.gd/arduino_programs_francais.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2aa6f7c-08fd-41e6-a4d2-8b5fbe6d5291/86681182178.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6098165-82e0-47c5-b467-bd8e7bd713f6/jotokibajuwazogu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a2fa52a7-081a-4c5d-aa40-110bb66ad947/social_media_addiction_research_paper.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eef47174-06e3-42d7-8e34-612008a8782d/65375730441.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/962f4e5a-a971-49ae-b014-6dbef7a45611/64513179533.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a86a9c2-0c58-46d6-ac6d-7e28f9525cc4/pujebojowilexorapetaf.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fef0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEF0 | 5620 bytes |
SHA-256: 776b09d691b24224d71498a3cab1782abc4d520dc1446b24a1c17b217afb4b19 |
|||
font_01_sfnt_off000111df.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111DF | 11760 bytes |
SHA-256: 9f8a285e38e355e9c3bd97f45f5a27755772e2dbca3c6056c3cb596ef0d7f419 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.