MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document contains numerous embedded URLs, with at least one pointing to a suspicious domain ('kuzutuzo.ru') that appears to be part of a link farm designed to redirect users. The presence of these links suggests an attempt to direct users to malicious websites, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=how+to+clean+bissell+proheat+2x+revolution+pet+pro PDF link annotation
- http://mazers.fun/91365621430jibjz.pdfIn PDF document text
- https://cdn.sqhk.co/duponetix/Fkhjmjg/579614091.pdfIn PDF document text
- http://toolsbestpricemicrometer.site/numagazasofovabirokelokre0ot.pdfIn PDF document text
- https://cdn.sqhk.co/tawavumazo/Y938iel/27595428248.pdfIn PDF document text
- http://flylovel.com/how_to_use_serato_dj_lite_with_spotifyskrk1.pdfIn PDF document text
- http://afracheat7.xyz/driver_wifi_netbook_acer_aspire_one_happygp083.pdfIn PDF document text
- http://workbykoder.xyz/975725597783eoii.pdfIn PDF document text
- https://cdn.sqhk.co/pevejotomoma/bxghhDM/flight_simulator_2018_pc_game_free_download.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5068d35d-cbe3-4fd3-89a2-b91c7ec9a02a/texas_instruments_ba_ii_plus_professional_tutorial.pdfIn PDF document text
- https://1ec9b6e7-17eb-4e1e-a994-ba5ce4cbdb7c.filesusr.com/ugd/d4a9d6_a8b996777d4d4258b57e097936a2b96c.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tanapilamaxi/dell_precision_m4500_technical_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cea1d4ea-9c8d-4a98-a0cc-1d843939bea7/53087065372.pdfIn PDF document text
- https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_42342a312df4429bb61dc16ab14db8be.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pizivurapab/what_does_the_term_30_for_30_mean_in_5w-30.pdfIn PDF document text
- https://146c8b6c-0b46-450b-8ed0-b45f1e2a4974.filesusr.com/ugd/b58d21_aa4c7b68af0e4757bc6019d3fdd25547.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a7ba5509-65f6-4ec2-94ae-68a6453301e2/gamesir_t1d_controller_pairing.pdfIn PDF document text
- https://s3.amazonaws.com/tuxenipup/online_fact_sheet_maker.pdfIn PDF document text
- https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_c62e55fc14434cb8938237e04bf0c3b9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/somisilegex/8868223523.pdfIn PDF document text
- https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_e6514a8b14b74b1fa01dd275f7c05128.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4e57b713-4ace-478b-87a7-39ce70df8ff9/tenanupususugapujavefonag.pdfIn PDF document text
- https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_63a413e278ec400e8dff8c5223924ec6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e3f7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3F7 | 5476 bytes |
SHA-256: 37ba1def18f968f3879714d08301dad88f219c938a48766ed423c7027b66c308 |
|||
font_01_sfnt_off0000f6a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6A3 | 10988 bytes |
SHA-256: 1f45fe09c7f185556efd34fa425785c8ca2daab1350db7c782fcbb16b74372b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.