MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which point to suspicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing lure designed to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9901
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/123?utm_term=bishop+chess+piece PDF link annotation
- https://fategebedabeno.weebly.com/uploads/1/3/4/7/134718848/085e8efba9fb565.pdfIn PDF document text
- https://ziwagunu.weebly.com/uploads/1/3/4/8/134883986/xogemimiberu-gajefito-xudilaxerab.pdfIn PDF document text
- https://xopigitit.weebly.com/uploads/1/3/4/3/134339451/4611330.pdfIn PDF document text
- https://vefaruturibil.weebly.com/uploads/1/3/4/5/134525254/c90b9435292.pdfIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
- http://smc.org.inhttp://smc.org.inIn PDF document text
- https://uploads.strikinglycdn.com/files/0b2077c8-b0b6-4dfd-847c-ce03746afafb/woruvumud.pdfIn PDF document text
- https://s3.amazonaws.com/makumapikeze/bearing_size_chart.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55ffbdac-3930-469d-8399-d435f5d5ed4c/super_sniper_efi_dual_quad.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/979db26b-81f7-4ed3-a530-7cc2bfaf59e0/37338350325.pdfIn PDF document text
- https://s3.amazonaws.com/kabisebax/17418827624.pdfIn PDF document text
- https://s3.amazonaws.com/bifadiwuwileji/haleyville_high_school_al.pdfIn PDF document text
- https://s3.amazonaws.com/jeduzizonox/budikebizolu.pdfIn PDF document text
- https://s3.amazonaws.com/wipotegadodorek/break_into_the_dark_song.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
Extracted artifacts 9
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_007_off00013065.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x13065 | 1772 bytes |
SHA-256: 30a1b1f8e8675de85e4e0cbbf65137645ba776f6f4eb95f6a10124fb1674eda2 |
|||
stream_010_off000174e8.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x174E8 | 17652 bytes |
SHA-256: 58c0b6be5327a06be5304cfbc734b3167e2347cc904d791acbd7ab029de6b27f |
|||
font_00_sfnt_off0000fabe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFABE | 3596 bytes |
SHA-256: a81e36d37c18c1d3ba261fd1d2bf5c7aa826f684e364c5212321bbc3846617b2 |
|||
font_01_sfnt_off000107b1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107B1 | 4732 bytes |
SHA-256: 07dd8d246fec76181c1bd2e55ed492db5336ff26705223e88439576c0b43cda7 |
|||
font_02_sfnt_off000117d1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x117D1 | 3788 bytes |
SHA-256: f1ed3525b17ed1d0bfa5b549255d20e90d86df1c6c4ffeac3cf8f926c3053dac |
|||
font_03_sfnt_off000125be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125BE | 2708 bytes |
SHA-256: d6eaa14f764b309d50897439c44fa5ce6252055cc52dcdbdb6c0133a299ad21a |
|||
font_05_sfnt_off00013984.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13984 | 2116 bytes |
SHA-256: dd675b2efb4752b278d742ba759d06ce4fd1b7f612699dd6292bb5b4dd6cfd9f |
|||
font_06_sfnt_off000143b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x143B5 | 17380 bytes |
SHA-256: 5963169ad9b7c26a518b37a29fefcc6cf6a5341d13dc236835e00da9b35d0954 |
|||
font_08_sfnt_off00018ed9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18ED9 | 2816 bytes |
SHA-256: 2f2685c7617e4b9cd47ba0dac2359da1a32c5e5f2a757819bc833bc989297fcd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.