MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with a significant number pointing to disposable domains and link farms, indicating a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a lure to external malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9970
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/wix?keyword=uncharted+waters+online+cooking+guide PDF link annotation
- http://timurberg.ru/gexagomunaxepowgbjcb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450730/normal_5fe9a22f926f8.pdfIn PDF document text
- http://fragcups.com/51826442868w4mw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384851/normal_603d2076ba0fc.pdfIn PDF document text
- http://fruitslope.online/stihl_chainsaw_model_025_chainsaw_manual2j9hr.pdfIn PDF document text
- http://nicepics.xyz/gemela4yg0y.pdfIn PDF document text
- http://moxumepavigotuf.iblogger.org/xoruxikokijokemazinemesuj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://pekarenov.rf.gd/sodebenimuralibi.pdfIn PDF document text
- http://wodefelid.rf.gd/rixas.pdfIn PDF document text
- https://9f2a6cc1-6e15-4467-beaa-57274ca996ed.filesusr.com/ugd/78f4c3_88c82b45d7bf4b8ebc86b843ea2c669d.pdf?index=trueIn PDF document text
- https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_c710caab008f4dd4807711d9062890c5.pdf?index=trueIn PDF document text
- http://ferobinosu.epizy.com/anencephaly.pdfIn PDF document text
- https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_b5edd02b09e342f5b36d255795428619.pdf?index=trueIn PDF document text
- https://f3ea461b-95fd-44cf-949c-5afda193840f.filesusr.com/ugd/a48928_350f5757a5484d5786da97ec2d894dc4.pdf?index=trueIn PDF document text
- https://5b2b9875-3923-4577-9ef6-0527498c95e7.filesusr.com/ugd/4e6dd5_00e85a4887fb4fbcbe42b837b45a37ac.pdf?index=trueIn PDF document text
- https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_7eabe8def6a34274a3e9172f6ce00e81.pdf?index=trueIn PDF document text
- https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_567f52b046a8435081e29a224f8562e2.pdf?index=trueIn PDF document text
- https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_d4fb83cf154340dca066e00f71838f8d.pdf?index=trueIn PDF document text
- https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_34a76262867047d18da973654d324022.pdf?index=trueIn PDF document text
- http://nisifibuvez.epizy.com/lic_jeevan_amar_proposal_form_download.pdfIn PDF document text
- https://e5baaea7-7007-41de-9367-4ebf3ed55875.filesusr.com/ugd/8e1900_7629ee016bd8402796b28481043e492a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000223c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x223C1 | 2896 bytes |
SHA-256: f68ca040ff5829d08d4bb6bdf1d80f8c62497358b93798cf9e66a553993eb265 |
|||
font_01_sfnt_off00022e13.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x22E13 | 5348 bytes |
SHA-256: 43492b4a71282f6794f197fa58a1014712c1c26afb11e8e0f95a60384c9ac2f6 |
|||
font_02_sfnt_off00024048.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x24048 | 6068 bytes |
SHA-256: 58b4873d33ac9fffaf45ed1a2312b8eb5fadf3b067e77f8cfe9e87095f6a7717 |
|||
font_03_sfnt_off00024ff9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x24FF9 | 11816 bytes |
SHA-256: 405802d10cae57a5accc08f985b4601ae48cc7753d34fa2f43a17e9969ab039f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.