MALICIOUS
226
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
T1059.007 JavaScript
This PDF file was detected as malicious by ML classifiers and ClamAV, exhibiting characteristics of an advance-fee scam. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users. The document body, though truncated and obfuscated, appears to contain keywords related to product searches and document metadata, likely serving as a lure to encourage clicks on the embedded malicious URLs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=craftsman+electric+trimmer+line+replacement
- https://babibogek.weebly.com/uploads/1/3/1/3/131379554/3100499.pdf
- https://tesafugefiwa.weebly.com/uploads/1/3/5/3/135318727/2161011.pdf
- http://jesubenodewopob.22web.org/43841685933.pdf
- https://cdn-cms.f-static.net/uploads/4409250/normal_600fa13f183e3.pdf
- http://majedox.iblogger.org/mary_poppins_book_plot_summary.pdf
- https://latoratepowubum.weebly.com/uploads/1/3/4/7/134713938/1663269.pdf
- https://lanekugufer.weebly.com/uploads/1/3/5/3/135351315/runawumumujeb.pdf
- https://static.s123-cdn-static.com/uploads/4495860/normal_5fcd9bb4e4b7e.pdf
- https://sotogirepatobob.weebly.com/uploads/1/3/1/4/131453915/1628327.pdf
- https://cdn-cms.f-static.net/uploads/4459165/normal_605382ec58d2d.pdf
- https://wadoruzog.weebly.com/uploads/1/3/1/3/131379034/todixuwefo-jafuwanedoxeki-fixiva-tulodufez.pdf
- http://rujawobezixevib.iblogger.org/72118320931.pdf
- https://takadoturig.weebly.com/uploads/1/3/4/1/134108809/modukajimokewo-sugaji.pdf
- https://static.s123-cdn-static.com/uploads/4487632/normal_6001907aed911.pdf
- https://ziresaro.weebly.com/uploads/1/3/4/5/134509830/bemizerokulolusel.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://gasikogo.rf.gd/14924012450.pdf
- https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_9a5ffddc383343d2a8cc4342a5712b55.pdf?index=true
- https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_624820eade76418db94e6dd7d739a63a.pdf?index=true
- https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_c8cd730fea584104a4fa75ce7d73f9ac.pdf?index=true
- http://selamamoli.epizy.com/wijujebofekalunovajamo.pdf
- https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_5e46eaeafffc4f978688498294b63bab.pdf?index=true
- http://ralodanuf.rf.gd/fevawanawukusabutoda.pdf
- https://4192d618-ecd7-4808-8485-efd4d6773ded.filesusr.com/ugd/17a5db_7ac7e298c62747389cd62533729cf0a6.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f278.bin681a647920516159bc12c14c7c688f0ac0e8374fd6d1d3b028147a8508df13ef |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF278 | 4860 bytes |
font_01_sfnt_off000102dd.bin442cb37dfe42742891e05ca76bfa3feecbda6d0133e6d90fdbcc40d4082173f7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102DD | 11128 bytes |
font_02_sfnt_off000128d7.bin4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x128D7 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.