MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with a significant portion pointing to disposable domains and link farms, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a spearphishing attachment designed to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=what+constitutes+a+commercial+motor+vehicle PDF link annotation
- http://islta.fun/what_is_the_main_idea_of_the_true_story_of_the_three_little_pigsfkoqg.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402745/normal_603aa4e735db3.pdfIn PDF document text
- http://kersita.fun/bang_bang_nancy_sinatra_piano_sheet_music72r8x.pdfIn PDF document text
- http://shoppermarket.online/nautiz_x5_manualfqonx.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4416919/normal_5ffb988e1e291.pdfIn PDF document text
- http://kiwenalod.medianewsonline.com/muzagatadeliwolofaker.pdfIn PDF document text
- http://santand-es.com/57014043632on52y.pdfIn PDF document text
- http://doordash.fun/55565293015l8d7s.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4393190/normal_5fcf16be1b76a.pdfIn PDF document text
- http://sagunutu.medianewsonline.com/31118077083.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://kadoxosin.atwebpages.com/ap_physics_electricity_and_magnetism_cheat_sheet.pdfIn PDF document text
- https://4eb83289-b313-4542-b68c-79a1d4783db4.filesusr.com/ugd/f6336d_7a67fd907a9445978e9d510a70189782.pdf?index=trueIn PDF document text
- http://gevewodex.epizy.com/21207390210.pdfIn PDF document text
- https://cb0920a4-0dfc-4587-8161-bd3bf883b043.filesusr.com/ugd/df391a_71ccd9c31d894c3fbd0b42f99e5b25b3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/39f6e76c-b258-44c5-82b6-08779b3dee46/thank_you_mandarin_symbol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15ad557c-2c65-4ef1-ad8e-c27d6ca05a77/auf_google_maps_strecke_messen.pdfIn PDF document text
- https://8e8ef6ac-913c-489f-8395-c30730e7ba0a.filesusr.com/ugd/f39c52_f281418ec4524ca297afdb6203816d95.pdf?index=trueIn PDF document text
- https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_0730c4663f0a4597b00b2bd534f31e0a.pdf?index=trueIn PDF document text
- http://belinoremujuk.rf.gd/majexejatogesigixo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3348adb2-5512-436f-ac0c-6d3729e205b4/cardo_scala_rider_q3_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c044c23-0ee8-4e0e-b1f2-40a42016d874/what_does_rivers_of_blood_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c51f2d41-6fcb-4a3e-a10b-99add8d2fd0d/oracle_sql_advanced_select_statement_examples.pdfIn PDF document text
- https://57fc24c6-ba7c-430a-bdae-05304608b610.filesusr.com/ugd/bc9c68_e1e46e493e8b4f65927557e2fd0278ec.pdf?index=trueIn PDF document text
- http://rexefobixavater.myartsonline.com/sewotavabevopojinu.pdfIn PDF document text
- http://jatoxat.atwebpages.com/pedevudazilotisu.pdfIn PDF document text
- https://medlineplus.gov/motorvehiclesafety.htmlIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb9d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB9D | 5112 bytes |
SHA-256: f3ae232de0e3ea2ae280bc3ec62c96752e78c404a6c02f4b49115f5ab0a41a63 |
|||
font_01_sfnt_off00010ce1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CE1 | 10928 bytes |
SHA-256: c54cdab070dfbbf8b56c643cc3b94ab131b0725865204c9a190b579ec5bbd39a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.