MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1204.002 Malicious Link
The PDF contains numerous external links, with one specifically pointing to a 'western union receive money form pdf' lure, indicating a phishing attempt. The heuristic 'SE_PAYMENT_REDIRECT_LURE' further supports this, suggesting the document aims to trick users into updating payment details. The presence of a large number of external links, including a link farm, suggests a broader SEO poisoning or redirection scheme to host malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9947
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LUREDocument describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=western+union+receive+money+form+pdf
- http://smotrikino.fun/aaru_video_songs_tamilmb1fo.pdf
- http://bestpriceforukraine.xyz/pokemon_yellow_walkthrough_serebiikk4hu.pdf
- http://rokexulom.22web.org/86025731492.pdf
- http://leaninrzpd.site/formation_chaud_froid_et_plomberiewit5g.pdf
- http://kuvaviwupa.iblogger.org/24470021987.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://gifazewuki.epizy.com/nugogugikoku.pdf
- https://uploads.strikinglycdn.com/files/e8d5dc28-a980-4035-bc88-9dc12ffce497/gapadu.pdf
- https://uploads.strikinglycdn.com/files/458082e2-1e30-4ce9-8535-2cbf0607909c/how_much_does_the_dragon_ball_z_kakarot_dlc_cost.pdf
- https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_eb903cbda3274c0392d319b4bbb9d37c.pdf?index=true
- https://uploads.strikinglycdn.com/files/5f80b5a1-5320-42c6-9c0f-8fe62e8d560f/gta_san_andreas_superman_mod_cheats_codes_download.pdf
- https://c039f79f-855f-4b64-8838-30138aeea086.filesusr.com/ugd/6b78cb_9f4c8f1e3dfe471587103976fa34c0b2.pdf?index=true
- https://190d602c-e74a-4ea1-b1d2-d722d7947d0f.filesusr.com/ugd/1eddd4_a274d7141bdd47ac9e25c98276591e4e.pdf?index=true
- https://uploads.strikinglycdn.com/files/8e7d3987-2a5c-4883-80b3-879cc6c704f1/dinah_zike_foldables.pdf
- https://uploads.strikinglycdn.com/files/b24cdd41-965e-4488-8d10-9b2ea1499855/is_ezekiel_25_17_really_in_the_bible.pdf
- https://uploads.strikinglycdn.com/files/c9adda58-c10c-4af8-90a8-b7d1a5bfd454/remederivedig.pdf
- http://titesixa.rf.gd/37040737566.pdf
- https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_b828acfbae3844dda05f7b8e970c071f.pdf?index=true
- https://s3.amazonaws.com/wamatasamegu/conflict_resolution_in_the_workplace_worksheets.pdf
- https://d1e6aceb-f258-402f-b59e-92ecb386693c.filesusr.com/ugd/2cc58f_51d9fd2153c54099a4f2065f0cf9c4e9.pdf?index=true
- https://uploads.strikinglycdn.com/files/a3a9dd13-76cd-4418-b12a-a1795487d838/how_to_install_a_ceiling_fan_with_a_downrod.pdf
- https://s3.amazonaws.com/jajoxulabojaso/89481131436.pdf
- https://uploads.strikinglycdn.com/files/c46611a5-dd89-47c0-88f9-20492cf25f8f/watasuweredajura.pdf
- http://gokakotafabap.rf.gd/4318624070.pdf
- https://s3.amazonaws.com/lekezaru/how_to_check_spring_framework_version_in_intellij.pdf
- https://uploads.strikinglycdn.com/files/70a6af7a-f929-4c21-b5c6-278109827a7e/24368208022.pdf
- https://s3.amazonaws.com/jukoxisojow/magnetism_worksheet_for_5th_grade.pdf
- https://s3.amazonaws.com/zakunafu/zuguveberibefum.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010833.bin2632a87372005948181701ae704ff1e4101dd1e03db755eca8188ea0c9ebfae4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10833 | 5232 bytes |
font_01_sfnt_off00011a07.bineaad187ecaab0d733a1d024b48a1f11b4e5be98faf7fa40883afe000d856d016 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A07 | 11468 bytes |
font_02_sfnt_off0001416a.bin0566e262a06f2f274d6a89cf929aead8764496dd4915b005984510ea6d1bc740 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1416A | 16224 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.