MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many hosted on disposable domains, suggesting a link farm designed to distribute malicious content or phish users. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as a phishing trojan. The document body, though partially corrupted, contains keywords related to 'financial management' which likely serve as a lure to encourage clicks on the embedded URLs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=what+is+financial+management+class+12 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4454043/normal_5fc7f061741ed.pdfIn PDF document text
- https://mufudoxideli.weebly.com/uploads/1/3/4/5/134508761/7125507ff996.pdfIn PDF document text
- https://tumofevex.weebly.com/uploads/1/3/2/7/132710745/7490524.pdfIn PDF document text
- https://tivufotevomok.weebly.com/uploads/1/3/2/6/132682035/2157496.pdfIn PDF document text
- https://cdn.sqhk.co/ludukuni/jaihggG/farming_simulator_16_ipad_money_cheat.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369764/normal_6053d699ed0d0.pdfIn PDF document text
- https://cdn.sqhk.co/mudebijutene/jaiiwIV/30960123329.pdfIn PDF document text
- https://cdn.sqhk.co/nilubasikufa/0oMieK2/endodontic_treatment_journal.pdfIn PDF document text
- https://cdn.sqhk.co/letarezetap/CqLhfN7/localizar_mi_android_por_gps.pdfIn PDF document text
- http://jovopomutulilo.medianewsonline.com/from_hell_alan_moore_espaol.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4373008/normal_5ffcc3b70dc9c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453721/normal_602551663cd6e.pdfIn PDF document text
- http://forovasax.medianewsonline.com/2018_subaru_forester_2.0_xt_review.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://538d8494-0c7d-401a-b890-0485f6bc7bca.filesusr.com/ugd/29c71c_f60118a0a2b1466495ae431f51f3dbaa.pdf?index=trueIn PDF document text
- https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_ac358d9c72dc41b8a0f8a9f5cadf0747.pdf?index=trueIn PDF document text
- https://43081b45-6e48-4b43-b724-9328fda377ae.filesusr.com/ugd/26481d_d9f3a2164707419390cb9cd09773c252.pdf?index=trueIn PDF document text
- https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_e5d39b15f375448194ea9e2287c19fb2.pdf?index=trueIn PDF document text
- https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_c91808b144dc4f60825a07e1a3deb941.pdf?index=trueIn PDF document text
- https://9a4203bb-6ff2-4ef1-9c63-3f113f84a884.filesusr.com/ugd/ea9bdf_59f1ba1a04044bc3be0268d6a3a5ec68.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea0c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA0C | 5396 bytes |
SHA-256: bb7b2c7ab5ac02ff5971a5b59864872e77c996b8d892908bf051e287ccfc10cf |
|||
font_01_sfnt_off0000fc5e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC5E | 10476 bytes |
SHA-256: b2fb8f8012d74d78b96dcaa1abd4e4b11ac2e60971ce7415d298bfb85cd2f79f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.