MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains numerous embedded URLs, with one specifically identified as a link farm on disposable hosting. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of a URL pointing to 'mezovuduw.ru/strik' suggests a phishing or malware distribution attempt, disguised as a search result for a product.
Machine Learning
- Nyx PDF Classifier malicious score 0.8351
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=ps+vita+memory+card+adapter+where+to+buy
- https://gumakini.weebly.com/uploads/1/3/1/4/131414358/zolemedetero-xijofubutakuban-vulos-raboxuku.pdf
- https://cdn.sqhk.co/xibetevoxaj/bIihM50/fesuse.pdf
- https://noxurawikatiner.weebly.com/uploads/1/3/1/1/131163986/7450786.pdf
- https://cdn-cms.f-static.net/uploads/4370055/normal_6049ad32698da.pdf
- https://cdn.sqhk.co/mumoragato/fjhnJge/phoenix_wright_ace_attorney_walkthrough_case_1.pdf
- https://cdn.sqhk.co/fukonovum/gQaUiey/battle_souls_mod_apk_unlimited_money.pdf
- https://bitojobuf.weebly.com/uploads/1/3/4/8/134892495/3762299.pdf
- https://static.s123-cdn-static.com/uploads/4489057/normal_5fc87b87be16c.pdf
- http://wopazav.22web.org/dugakosowe.pdf
- https://tuwagufo.weebly.com/uploads/1/3/3/9/133999840/zijodexip.pdf
- https://cdn.sqhk.co/fudikuzi/UA4iejb/44750052189.pdf
- https://cdn-cms.f-static.net/uploads/4370744/normal_6022c6afe3d85.pdf
- https://static.s123-cdn-static.com/uploads/4497369/normal_5ff92d4f122cf.pdf
- https://cdn.sqhk.co/fujotojaxob/higZ2nv/real_city_car_driver_mod_apk_android_1.pdf
- https://s3.amazonaws.com/makumapikeze/17602308219.pdf
- http://dorofudi.epizy.com/synonyms_word_list.pdf
- https://s3.amazonaws.com/farowug/polycom_hdx_7000_admin_guide.pdf
- http://zowisoburime.rf.gd/30794795345.pdf
- http://tekubone.epizy.com/modern_physics_resnick_halliday.pdf
- https://s3.amazonaws.com/zoxewudunigus/bukajidizoximevigaj.pdf
- https://s3.amazonaws.com/gupojakami/33271888478.pdf
- http://foxugej.rf.gd/44150178866.pdf
- http://mipufaz.epizy.com/tezofuwerututala.pdf
- http://mubozezubudiz.rf.gd/diagnostico_ambiental_definicion.pdf
- https://s3.amazonaws.com/fotojipifuzitul/resumen_de_la_obra_el_alquimista_por_partes.pdf
- http://mowumaja.epizy.com/latest_responsive_website_templates_psd_free.pdf
- http://tuxowisinaxug.rf.gd/examples_of_inferential_questions.pdf
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fcf6.bin00c0a141202c10936ceac8b8df9df75720096dbedde9c5fde8d9f3447cbb363c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCF6 | 2960 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.