MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple critical heuristics, including PDF_MALICIOUS_REDIRECTOR_LINK and ML_NYX_PDF_MALICIOUS, indicating malicious intent. It contains a large number of embedded URLs, many of which point to link farms or potentially malicious redirectors, such as 'https://yafferge.ru/123?utm_term=waltz+no+2+piano+sheet+music+pdf'. The document body, though heavily obfuscated, suggests a lure related to 'piano sheet music pdf'. The presence of numerous external PDF links, as indicated by the PDF_SEO_LINK_FARM heuristic, further supports a phishing or malware distribution campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/123?utm_term=waltz+no+2+piano+sheet+music+pdf In PDF document text
- https://lufisadoxusixa.weebly.com/uploads/1/3/4/5/134583632/goxagaxitopidu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489050/normal_602b93315483f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4385026/normal_600323461701e.pdfIn PDF document text
- https://kabatinamipe.weebly.com/uploads/1/3/4/6/134636342/visomavifo-fexigo-zaduriju-gigamaze.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486552/normal_6000a60703bce.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368781/normal_60417c24a0410.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/widiku/95052573526.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/65ebaf11-a6c6-4a79-9641-3c5718ac12b2/introduction_to_law_enforcement_and_criminal_justice_11th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba2043c0-348a-490f-9a56-0bcf1ddc651d/audio_libro_el_seor_de_las_moscas.pdfIn PDF document text
- https://901c4554-6fda-40bf-8344-1f1538f5dc06.filesusr.com/ugd/a76634_217eef6dc8ba46d1a65593314f687719.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sepovutapakogaf/lurufatomil.pdfIn PDF document text
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_3d58815050d94c5a859a73f7bfa2f785.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sorogamat/24706787480.pdfIn PDF document text
- https://s3.amazonaws.com/lomogas/bluff_master_telugu_movie_720p.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc88fd66-c48a-4bb5-b139-b13700c7f04d/kamudofunumokat.pdfIn PDF document text
- https://s3.amazonaws.com/sesafefanulokam/geometric_shapes_worksheets_for_kindergarten.pdfIn PDF document text
- https://db6d201d-bdff-4648-9982-d9cfaac7639e.filesusr.com/ugd/98857b_2f060439e85c4e1cba130b78c3db4683.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kikunojulejuj/91620273041.pdfIn PDF document text
- https://s3.amazonaws.com/ravuxudibure/worry_tree_guided_meditation_script.pdfIn PDF document text
- https://s3.amazonaws.com/ponivotigegepub/aflac_cancer_wellness_benefit_claim_form.pdfIn PDF document text
- https://s3.amazonaws.com/ninasivol/gureviturirarevar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c671e36-e644-4605-8e98-726b616ad304/what_is_the_meaning_of_commerce_and_trade.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7ac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7AC | 5492 bytes |
SHA-256: 3b893559b311d32c14ddfeb007701b8f1fb91c2752e267541e9a68b58a961bb7 |
|||
font_01_sfnt_off0000fa4d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA4D | 10520 bytes |
SHA-256: 7fd71741b34f96c07942be8050d7eebf8310afdcb14742fe724ffde79a88e5a3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.