MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, contains fragments related to search queries, reinforcing the phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=why+is+the+red+light+flashing+on+my+panasonic+tv PDF link annotation
- http://forezofulafenu.iblogger.org/rca_rt2911_remote_control.pdfIn PDF document text
- http://veronaital.space/norcold_refrigerator_codesctzav.pdfIn PDF document text
- http://xalenupom.getenjoyment.net/349939395.pdfIn PDF document text
- http://rabuvuz.22web.org/chemistry_book_3_apk.pdfIn PDF document text
- http://zuzutogutid.22web.org/fujitsu_fi-6130_win10_driver.pdfIn PDF document text
- http://shimano-stradic.ru/42931892843nywuc.pdfIn PDF document text
- http://drive4mclanemilwaukee.com/631634986521g7r7.pdfIn PDF document text
- http://zavolofa.mygamesonline.org/jobipezux.pdfIn PDF document text
- http://karnaval.host/sailor_moon_and_sailor_chibi_moon_transformation5xhup.pdfIn PDF document text
- http://vedice.ru/49651269171og7iq.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/levumoduf/wales_v_ireland_2019_match_report.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fec5e309-5faa-40fb-bb4d-d2553a342cea/48580963661.pdfIn PDF document text
- http://rufevobovejexe.rf.gd/tuvezivuzodefejeko.pdfIn PDF document text
- https://s3.amazonaws.com/xukirizugukugi/jazzy_select_14_xl_battery_replacement.pdfIn PDF document text
- https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_7a6451997817444db3c8ce1bc11514a8.pdf?index=trueIn PDF document text
- https://fa3f2985-242d-4a4c-93c0-6adbfb259eaf.filesusr.com/ugd/8dbe7a_b583630a40a04cd7a12d404b3c38086e.pdf?index=trueIn PDF document text
- http://zejajedep.rf.gd/what_exercises_work_the_gluteus_minimus.pdfIn PDF document text
- https://dfa52777-3edb-460f-9b14-ca5101cd4ecc.filesusr.com/ugd/5360f8_d46c02d7757f40fda48125ed7d314b2b.pdf?index=trueIn PDF document text
- https://3175e58c-9db9-4d87-bcb9-15e03531d93d.filesusr.com/ugd/c93210_775ac039cce94a238a2590eda396f3c5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pewebopufupe/banquet_event_order_form_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57592a12-dae8-429b-8ca3-64b85eb9a068/gofadozazun.pdfIn PDF document text
- https://5a060084-92f5-4e09-b02e-bbac8bb45871.filesusr.com/ugd/05c943_cbf93e28bee14915ae1f2daf20f6c0c5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zosevid/3m_35_tape.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f9a0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9A0 | 5744 bytes |
SHA-256: 20ff7528b853deec56f1918c67e038d47322b092898c58713961f41710442f78 |
|||
font_01_sfnt_off00010d1e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D1E | 10828 bytes |
SHA-256: d1d72ff0f2f4a68e0f2f29527db3087ae4e533e791547c9738453e43ca2bc8ff |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.