MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains a large number of external links, many pointing to disposable domains, suggesting a link farm or phishing lure. The primary URL observed is https://vilenefex.ru/123?utm_term=the+way+you+look+tonight+lead+sheet, which is likely used to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/123?utm_term=the+way+you+look+tonight+lead+sheet PDF link annotation
- https://static.s123-cdn-static.com/uploads/4373281/normal_5feb292f05621.pdfIn PDF document text
- http://judijemavup.22web.org/78866166814.pdfIn PDF document text
- https://diveziriluro.weebly.com/uploads/1/3/4/4/134447321/7023474.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4477408/normal_5fe319e98797f.pdfIn PDF document text
- https://nidabiweni.weebly.com/uploads/1/3/4/8/134865500/nozuruzobudi.pdfIn PDF document text
- https://losaburi.weebly.com/uploads/1/3/5/3/135322327/maxabowuzoligad-xeposapali-refakududotez-parekapawo.pdfIn PDF document text
- https://danovijo.weebly.com/uploads/1/3/4/7/134774389/geteluvekagozitojawu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473902/normal_60369103513d9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4379486/normal_5feb9fbeeee21.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376382/normal_602968ab39949.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/1b3e26e2-afb2-4167-afa9-8abb1432d9f8/jinemigovejotakasajowuxim.pdfIn PDF document text
- http://kowifojabar.rf.gd/ccure_9000_hardware_requirements.pdfIn PDF document text
- http://manutilo.epizy.com/project_management_organogram_template.pdfIn PDF document text
- http://kuzebelinebofe.epizy.com/86606170393.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d29281a3-df5c-49d7-ae74-eddd226ce076/birijurizilil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2987c75-226f-498e-909b-4aa1fa9ce117/revolution_in_rojava_buch.pdfIn PDF document text
- http://mevedodaxaj.epizy.com/86307791134.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ca03b56-73e6-43ed-a555-557fb6667421/tagebajusutafus.pdfIn PDF document text
- http://jibogifimot.epizy.com/aadhar_card_photo_correction_form.pdfIn PDF document text
- http://gitavini.epizy.com/transformation_index_bti_2018.pdfIn PDF document text
- http://xexelakufakeze.epizy.com/zedatujapozavag.pdfIn PDF document text
- http://xasibaj.epizy.com/charting_outcomes_in_the_match_2017.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc80571b-cc45-4332-8b91-bf53f83587a5/39476543534.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66140129-64f3-4618-8bc6-146812d2393a/xedozu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000faa6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAA6 | 5196 bytes |
SHA-256: 7ad27fa4911fa9f2a543405b6cc1bc60a5b5715dd5b27d0422b8a034c3a7f4e9 |
|||
font_01_sfnt_off00010c72.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C72 | 10948 bytes |
SHA-256: 35284645b4efc251eacccee8d15a1209cd3109a043de7fe2ac19131572f3ee32 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.