MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=asus+rt-ac66u+dd-wrt PDF link annotation
- https://cdn.sqhk.co/fowifabibu/hbLTUuo/missing_persons_search_uk.pdfIn PDF document text
- https://cdn.sqhk.co/fofodafexadu/hccFTKS/bad_piggies_hd_apk_mod.pdfIn PDF document text
- https://cdn.sqhk.co/ketejeti/daEqDCG/38763883761.pdfIn PDF document text
- https://cdn.sqhk.co/vurifozi/a2jhbOo/60204159787.pdfIn PDF document text
- https://cdn.sqhk.co/nisugewameru/FecXyig/95117075422.pdfIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/rujabepifar/game_naruto_shippuden_petualangan_apk.pdfIn PDF document text
- https://8c805f22-5240-4a8e-9b4d-8499607ff1fc.filesusr.com/ugd/76156b_c7d02b9f0d294526bc2ba36c348e738d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wenobagupexekap/21196289920.pdfIn PDF document text
- https://s3.amazonaws.com/rujimidujek/sedogune.pdfIn PDF document text
- https://s3.amazonaws.com/semuxemakaw/what_are_the_benefits_of_an_evaluation_plan.pdfIn PDF document text
- https://s3.amazonaws.com/dozore/amityville_the_awakening_movie_free.pdfIn PDF document text
- https://s3.amazonaws.com/donukadizolin/business_english_test_with_answers.pdfIn PDF document text
- https://s3.amazonaws.com/legenapi/89895024149.pdfIn PDF document text
- https://s3.amazonaws.com/dejazuvorira/avancemos_2_reteaching_and_practice_answers.pdfIn PDF document text
- https://3b87a2b8-2d13-4e6d-acc4-cbba57692a59.filesusr.com/ugd/50988c_8a6cf25deb1243adbb36c754632d9678.pdf?index=trueIn PDF document text
- https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_570668ae1b09488496c9287529daf224.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jarawaxanivu/2941338649.pdfIn PDF document text
- https://s3.amazonaws.com/jedadokuti/54856564731.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_008_off00016223.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x16223 | 8084 bytes |
SHA-256: f48816b1075c3e2b4c4db2682408651861a282d8ec49d98e192341fb52757028 |
|||
font_00_sfnt_off0000fb32.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB32 | 5168 bytes |
SHA-256: 4066eb27ef963ad4e08e56ae65c067e01429e9e61e8cbbb59b07633563bf57b9 |
|||
font_01_sfnt_off00010ce7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CE7 | 3720 bytes |
SHA-256: 6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed |
|||
font_02_sfnt_off00011842.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11842 | 2144 bytes |
SHA-256: 04e8d6eb7840346664249f8c1b50e81f8677381d46f49ad100365bc02b08c7c7 |
|||
font_03_sfnt_off00012220.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12220 | 12268 bytes |
SHA-256: 9ddc855283bccd5ae3e06aa51a6ec16cff242310b177e0e9586f74bdd6940536 |
|||
font_04_sfnt_off00014a99.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14A99 | 16880 bytes |
SHA-256: 6ec229c24529a358c131ee313581d0f07f65b4fe3555c9b3ede32f1fcfcfb813 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.