MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains embedded URLs, with one prominent URL disguised with a search term related to 'tableau tutorial videos youtube'. This URL, 'https://dugedepap.ru/strik?utm_term=tableau+tutorial+videos+youtube', is hosted on a disposable domain and is flagged as a link farm, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect the user to a phishing site or download further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=tableau+tutorial+videos+youtube PDF link annotation
- https://cdn-cms.f-static.net/uploads/4468837/normal_6021a42b396a1.pdfIn PDF document text
- http://vubitim.sportsontheweb.net/past_simple_regular_verbs_negative_exercises.pdfIn PDF document text
- http://bamirajewenexo.medianewsonline.com/dumedufuzesujas.pdfIn PDF document text
- http://vuwimoxit.mygamesonline.org/provinsi_bengkulu_dalam_angka_2020.pdfIn PDF document text
- http://femukujisidape.iblogger.org/airdroid_free_for_laptop.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449424/normal_6006441ab700c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464522/normal_5fdd63699c49d.pdfIn PDF document text
- http://nubupexajed.iblogger.org/takeuchi_tb240_manual.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370746/normal_6044926149bc2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6439a6ea-41df-4aef-962b-a866e432c8bf/i_am_that_guy_meme.pdfIn PDF document text
- http://tixofimisupabev.onlinewebshop.net/glandula_de_bartolino_anatomia.pdfIn PDF document text
- http://pareruwawetis.rf.gd/blackstone_fortress_escalation_kill_team.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5bf9ed7-bd99-4048-a3d7-ec8b3ae16d87/pebuvawabumonosegub.pdfIn PDF document text
- http://nitupodok.epizy.com/wizejif.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73a38d34-8c8b-4d36-8c8e-5b7e511e246f/what_is_the_40th_day_after_death_called.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce7840a4-3a8e-4024-acac-65b4413e8a3a/ohio_university_football_parking_map.pdfIn PDF document text
- http://tebaputazaxuva.myartsonline.com/zedelupefowexodogaguvo.pdfIn PDF document text
- http://jeruzofifisamen.rf.gd/cm_14_custom_rom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8e3b4da-dce9-4e4d-8600-d5b519cd0079/fosugevagoloropatogapumez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6cf33d6-e394-448b-ad5a-d0c435a553a9/solving_quadratic_equations_worksheet_all_methods_doc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28c993f7-5172-426b-bddd-6e4ba25d8692/winters_bone_chapter_20_summary.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef67.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF67 | 5072 bytes |
SHA-256: c370d86b98da7cf51d2a6d56d2d5d8846dcd761ce76e7e46426f3d328cf3f5ad |
|||
font_01_sfnt_off000100b7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100B7 | 10856 bytes |
SHA-256: db81bd45c2adc5e04ca3c5d37dcf9f5df2d767acb2a08b59b5f4152f5a9ba5e4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.