MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with one identified as a potential link farm. The ML classifier and ClamAV detection strongly indicate maliciousness, specifically a phishing or trojan threat. The document body, though heavily obfuscated, contains text related to a '4 piece puzzle template editable', suggesting a lure to a malicious website.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/123?utm_term=4+piece+puzzle+template+editable PDF link annotation
- https://nipibodofabujid.weebly.com/uploads/1/3/4/2/134265940/vudono.pdfIn PDF document text
- https://zaxiradijewebox.weebly.com/uploads/1/3/4/8/134889682/bevixagarubarimupox.pdfIn PDF document text
- https://bisaderivulele.weebly.com/uploads/1/3/4/7/134744485/puradowi_vagoxavizexewuk_dewef.pdfIn PDF document text
- https://menedusuwoguv.weebly.com/uploads/1/3/4/6/134699995/fotepitapowaju_muxoligemekox_piteruzebokesu_mebogemad.pdfIn PDF document text
- https://rezosegog.weebly.com/uploads/1/3/2/8/132814067/9c38743.pdfIn PDF document text
- https://kenomixu.weebly.com/uploads/1/3/0/9/130969587/260f49.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6d766529-3409-4403-b5b7-eeb2ae40860e/80414986962.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d858902-67c8-448c-a4de-e694faa33003/rizukoxo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9555d234-0d3b-45f5-a07c-043f2e74550d/how_to_write_irish_address.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d1d055e-3f16-485f-9d40-83268ea3a2ff/how_to_get_free_gold_on_need_for_speed_no_limits.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b640c118-1f53-4274-adb2-3a3ef62be814/estudios_bblicos_sobre_el_poder_de_la_oracin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d71fe4c-6958-4e14-b1de-1f60242ec15a/10316236455.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/33b5d2d6-98f2-441b-b3ff-7de0d1f10cb4/49495319650.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fed62195-e625-4e2b-9845-b5212e6bd0dc/how_to_reset_sharp_window_air_conditioner.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbe8c6e9-a602-415b-8438-5138641db076/zuzudulo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/60f84453-4bc2-4157-acb0-cacbdc8f9958/pioneer_receiver_vsx-819h-k.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e2e2b18-8cb6-417c-9375-0323912b22c1/what_causes_low_power_in_a_diesel_engine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/480c71d7-8dfc-4810-b18a-1bdd444d8d9b/49377719510.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/34628c19-78b8-4c39-8780-e8129abda549/bible_study_lessons_on_forgiveness.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a37ae813-eee9-475c-b0a5-801860fef4c3/teco_fm50_fault_codes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4cc087cf-1fe7-4bb1-850c-ac5a428a996e/96575550390.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b9ddb0fe-2afa-4c5c-911d-c7edfc21307b/how_to_draw_manga_characters_a_beginners_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e95ca956-b037-4931-b7e4-bcfa1af5eca2/what_is_the_use_of_gravimetric_analysis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2fd5d5aa-2592-4f65-89e7-8bc07984820c/how_to_avoid_gaining_weight_after_gastric_sleeve.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb03b857-721d-46f4-b3f6-c35648c4b59b/gufusovowex.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f86a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF86A | 5128 bytes |
SHA-256: acbafe7d809b8910f851568e97b56118b168917142e302b833bffe762da83da5 |
|||
font_01_sfnt_off000109cb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109CB | 10888 bytes |
SHA-256: 5a01f2b472ee4bf590da4f88b2d6fa182ea0efb0d0f13cfc33ec5a4eadd69ffd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.