MALICIOUS
226
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
T1059.007 JavaScript
The PDF file contains a fake CAPTCHA prompt, a common lure to trick users into clicking malicious links or executing further code. It also includes numerous external links, with one pointing to 'botokaw.ru', suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHADocument displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=snow+white+with+the+red+hair+season+2+episode+13
- https://rowiteruna.weebly.com/uploads/1/3/4/4/134470704/1a6284.pdf
- http://kivolugog.mypressonline.com/zerokifi.pdf
- http://kunozoxutokusu.mygamesonline.org/euro_truck_simulator_2_activation_key_images_download.pdf
- https://cdn.sqhk.co/kutajanode/wjhshiT/ruvisofuboginotuva.pdf
- https://samoxaposem.weebly.com/uploads/1/3/4/3/134361226/sudiropumela_kisogezaj.pdf
- https://wejumarokurefa.weebly.com/uploads/1/3/0/7/130776247/takijosij.pdf
- https://cdn.sqhk.co/togokitaz/c9jhagd/fastlane_road_to_revenge_hack_mod_apk_download.pdf
- http://duwinijuj.mypressonline.com/78908982467.pdf
- http://nipawifaxupus.mygamesonline.org/66387832968.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://d6aab468-caab-4d9e-910f-d3bf64ae4104.filesusr.com/ugd/5438e3_e88b245abe154f88b4735374176d04fd.pdf?index=true
- http://tefetuzuzip.myartsonline.com/78196553504.pdf
- https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_cb69c30553dd461ea3509f0e2bb39f35.pdf?index=true
- https://4c80ca50-31de-4e6f-b265-471620011c4a.filesusr.com/ugd/08c6b7_1c2b064d20924ff89dcd8f1e34aa5297.pdf?index=true
- https://52b03d57-94e3-497b-b2ee-5a576b8f136c.filesusr.com/ugd/67ae49_86eb6a6dbe0c4301befeb1bcfb5bc9fa.pdf?index=true
- http://bexexakik.myartsonline.com/pocket_anesthesia_2nd_edition_free.pdf
- https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_9c51b603f875409598b25318c01d6841.pdf?index=true
- https://afa032df-bfad-47da-a9c8-c79260182993.filesusr.com/ugd/6f9b04_bb9c91d7e3fc45fd90cb10b350619ab2.pdf?index=true
- https://4bc473c2-84d0-4913-8b4e-281bf44fba2e.filesusr.com/ugd/a25dbd_cd84ecb1dd674ba3a0ea7ccc71322ff2.pdf?index=true
- https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_0cded7dc08c04180965ff7657113a61c.pdf?index=true
- http://jubogaju.atwebpages.com/20110150660.pdf
- http://merapenerabari.myartsonline.com/free_online_scanned_to_word_ocr_converter.pdf
- https://f6180879-d31b-499c-8e42-fead7842c491.filesusr.com/ugd/007227_4bd132efe75d4404bdee3beba799dbdf.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011acd.bina9b94413a876a3834ff83d459c54d2612183f5359d27594fedb63788fbded708 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11ACD | 5656 bytes |
font_01_sfnt_off00012e93.bin48b29804c973d90b172f14f9f39bafcaefd9187c3fa4f9cbf0ce59412816d1b8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12E93 | 5560 bytes |
font_02_sfnt_off00014192.bin63bc4578939e204ecc6032a92d634a207f292573bd2209122af2366660e3c48f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14192 | 13404 bytes |
font_03_sfnt_off00016c88.bin9cd8e747659bbead4435b146d5b1cab14327765c7780645e45af0b1b10bbf1fd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16C88 | 17252 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.