MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with one pointing to 'golowaki.ru', suggesting a link farm or phishing lure. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as a phishing trojan. The presence of embedded URLs and the PDF structure point towards an attempt to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=bandai+millennium+falcon+1%252F144+dimensions PDF link annotation
- https://kuvugelovusilu.weebly.com/uploads/1/3/4/4/134437140/boluletabovofag.pdfIn PDF document text
- https://wizenifove.weebly.com/uploads/1/3/4/3/134308138/netovipazib.pdfIn PDF document text
- https://cdn.sqhk.co/voxobidivel/bggThhy/35624254259.pdfIn PDF document text
- https://cdn.sqhk.co/zimidenex/eZbUEhg/jumia_black_friday_ghana_treasure_hunt.pdfIn PDF document text
- https://cdn.sqhk.co/lekuruzomef/idgewhg/demon_hunter_dungeon_gift_code.pdfIn PDF document text
- https://cdn.sqhk.co/gixekoji/icifXif/tesla_first_electric_sports_car.pdfIn PDF document text
- https://baraxuworasexe.weebly.com/uploads/1/3/4/6/134633060/5052466.pdfIn PDF document text
- https://cdn.sqhk.co/dexavoba/OdibBgh/47104775119.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://01dc7cc6-b8ed-446e-8cc8-1ad78882ed38.filesusr.com/ugd/e23fbb_9fc9c60df6f743e6b2125253ed75d1ed.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pevuwarobuvowa/difogevafonomijijegit.pdfIn PDF document text
- https://s3.amazonaws.com/mokixetat/91707960814.pdfIn PDF document text
- https://s3.amazonaws.com/rufonali/bugatti_hd_wallpapers_1080p.pdfIn PDF document text
- https://ebd73b9a-b255-48a5-b781-2bd84b483b4c.filesusr.com/ugd/956c05_b945c988fbbf456b8350f73f6a2aa5cb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/db615d36-5b90-4b83-a7c1-ee73968db278/pivudadovedara.pdfIn PDF document text
- https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_1ca81f95a0c0483cbc8490d99f3e8342.pdf?index=trueIn PDF document text
- http://jevabatogi.rf.gd/haier_5000_btu_air_conditioner_not_cooling.pdfIn PDF document text
- https://s3.amazonaws.com/mudurixo/structural_adjustment_programme.pdfIn PDF document text
- https://7f1d4f38-7308-4051-b389-b8ed31312188.filesusr.com/ugd/e948c1_aaa1843336934d218b3c5c7007da776e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b70e0330-14fe-4611-8d6d-e5b4b60b4a9d/teatro_en_casa_samsung_ht-j4500k_precio.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4eb9933b-78b7-46af-be5b-3bf1010896bb/burger_king_nutrition_uk.pdfIn PDF document text
- https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_134749cedd87491daaeef46c8a34e3a2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bd1e2927-6948-4bfd-b50c-7b89e4deb529/hp_laserjet_4050n_win_10_driver.pdfIn PDF document text
- http://bozumux.epizy.com/92582449479.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001948d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1948D | 5100 bytes |
SHA-256: 6452db9cd7c8b7c5af737cb9edcbd0938f8f773d4f802fc36ad00af28d6f3410 |
|||
font_01_sfnt_off0001a5d7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A5D7 | 11504 bytes |
SHA-256: a45cf72c971a5292b55a9f4164081b7624c334d800d6e0d002f3b1dd9746af90 |
|||
font_02_sfnt_off0001cc00.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1CC00 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.