MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was identified as malicious by a machine learning classifier and ClamAV, indicating a phishing or trojan payload. It contains a significant number of external links, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious content. The embedded URL `https://lozipotod.ru/strik?utm_term=rent+musical+full+script+pdf` is a primary indicator of the phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=rent+musical+full+script+pdf PDF link annotation
- https://static.s123-cdn-static.com/uploads/4386829/normal_5fcfb204d683d.pdfIn PDF document text
- https://cdn.sqhk.co/nebemina/cht9sdA/kexozazenunosugadupodo.pdfIn PDF document text
- https://moxujudafetofa.weebly.com/uploads/1/3/2/7/132712376/f9b7413d7eeeb.pdfIn PDF document text
- https://losewilim.weebly.com/uploads/1/3/4/8/134854933/1533041.pdfIn PDF document text
- https://vomerigovelaj.weebly.com/uploads/1/3/4/9/134901888/zixofupolubinur_zinirunej.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4380229/normal_5ff9d823d4509.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454807/normal_5fda2d051243f.pdfIn PDF document text
- https://cdn.sqhk.co/lilaxikixo/gPifhhc/actor_tycoon_2_download.pdfIn PDF document text
- https://fazukowabawubi.weebly.com/uploads/1/3/1/4/131407802/tixeki.pdfIn PDF document text
- https://cdn.sqhk.co/pekotegafod/jgUqmhO/soxesoxuvoxawagi.pdfIn PDF document text
- https://wifadesar.weebly.com/uploads/1/3/5/3/135345928/bf17d7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366639/normal_5ff4508e25e3a.pdfIn PDF document text
- https://muwemobivom.weebly.com/uploads/1/3/0/7/130776082/kemuxojo_penakunona_papipal.pdfIn PDF document text
- https://dojilosadokadog.weebly.com/uploads/1/3/4/8/134890500/3635360.pdfIn PDF document text
- https://cdn.sqhk.co/rekubapapup/hNMd4GT/fosinoxikunarobitimol.pdfIn PDF document text
- https://koxawikala.weebly.com/uploads/1/3/4/6/134643159/b52fb32f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://joxegav.rf.gd/30884279269.pdfIn PDF document text
- http://sewodup.rf.gd/viselawil.pdfIn PDF document text
- https://s3.amazonaws.com/gewuwasi/38796245038.pdfIn PDF document text
- http://tajegigug.epizy.com/56111693342.pdfIn PDF document text
- http://gelutusuxipedib.rf.gd/abbyy_transformer_2._0_crack_free.pdfIn PDF document text
- https://s3.amazonaws.com/nitidadufetenu/stem_and_leaf_diagram_questions_and_answers.pdfIn PDF document text
- https://s3.amazonaws.com/wuxupewu/16674253751.pdfIn PDF document text
- http://momabuxamejuwev.rf.gd/buwinimuxajinajidugora.pdfIn PDF document text
- https://s3.amazonaws.com/rikolesafuwofar/anaganaga_oka_ooru_violin_ringtone.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001ff01.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1FF01 | 5308 bytes |
SHA-256: a5542567047abd0348034f68f93a1ecb257752d3a3be00eb7327cad12da50f04 |
|||
font_01_sfnt_off000210fd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x210FD | 11084 bytes |
SHA-256: 7f6ee052911c6daebb1e76efad4aacbc790720269433759360817db4b83cf01a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.