MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, many pointing to SEO-optimized redirectors, suggesting a link farm or phishing campaign. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL `https://kuzutuzo.ru/123?utm_term=cube+attain+road+bike+size+guide` is likely the primary destination for the malicious payload or phishing content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/123?utm_term=cube+attain+road+bike+size+guide PDF link annotation
- https://static.s123-cdn-static.com/uploads/4477863/normal_5ffcb26eadd98.pdfIn PDF document text
- https://nagejezesalu.weebly.com/uploads/1/3/0/8/130874580/2354a3e1399207.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427523/normal_6022dde3b2772.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384835/normal_6047b002b010a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4468536/normal_6004f0764f454.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489981/normal_60264ea0c087b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408321/normal_6031f850570d6.pdfIn PDF document text
- https://japarikadag.weebly.com/uploads/1/3/4/1/134108792/donipasonevula_bibositab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373526/normal_5fdb668b40418.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426815/normal_5fd04b6f73235.pdfIn PDF document text
- https://nafizanoride.weebly.com/uploads/1/3/4/5/134596231/a1aa2635a.pdfIn PDF document text
- https://wufezaju.weebly.com/uploads/1/3/0/7/130738917/d853a8a6cb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453563/normal_601095771f7d4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4401546/normal_603c30539f34f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488581/normal_603a7a33b52de.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/222ebf96-7bb8-46df-a4a3-44475392e3ea/66063589471.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b79e7b0a-7688-4aa1-b38e-4e30c4c7f69e/the_great_gilly_hopkins_plot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/897d015e-f5ff-49bb-8149-ec9600d7c1a2/gadaxupu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c0e19dc-ea09-4658-8e91-226267f0eb52/fujitsu_halcyon_light_codes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a0fc496-1b63-40d2-88bf-cc77b9906923/la_chanson_de_lcole_je_suis_au_cp_paroles.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f762aa25-694c-4bae-b13e-a515dffbbc35/what_is_the_best_summary_for_a_resume.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/834aeea6-1560-43b8-9db3-59ca6a28ae72/38930009646.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f8f4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8F4 | 5120 bytes |
SHA-256: 38574b8c589d95bc1540c559c5da872e147fe4129756c9b64a8e8cd7d75e04a5 |
|||
font_01_sfnt_off00010a6f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A6F | 10836 bytes |
SHA-256: 702ed460697044b155c5429084ed218a305e297c0e3dd4140c1c00e65bcf89cf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.