MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with one prominent URL being https://queure.ru/pbw?utm_term=curt+bergfors+net+worth. This suggests the document is designed to redirect users to potentially harmful websites, possibly for phishing or SEO spam.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://queure.ru/pbw?utm_term=curt+bergfors+net+worth
- https://cdn-cms.f-static.net/uploads/4423752/normal_605c48287a2f7.pdf
- https://cdn-cms.f-static.net/uploads/4393626/normal_606ea54980811.pdf
- https://towelekuw.weebly.com/uploads/1/3/1/4/131406253/716182.pdf
- https://cdn-cms.f-static.net/uploads/4371258/normal_605eeb0048a6c.pdf
- https://xuratofojiwob.weebly.com/uploads/1/3/4/0/134096374/jenaxukutulepim.pdf
- https://xasugalepo.weebly.com/uploads/1/3/4/3/134311154/gamituwon_ruxixekuf_wulobe_vedugenodon.pdf
- https://wemoloxemud.weebly.com/uploads/1/3/4/6/134603697/3759551.pdf
- https://cdn-cms.f-static.net/uploads/4404113/normal_60bddcb66906f.pdf
- https://cdn-cms.f-static.net/uploads/4380883/normal_5fd7a6dc52def.pdf
- https://static.s123-cdn-static.com/uploads/4405642/normal_5ff6561c1d502.pdf
- https://cdn-cms.f-static.net/uploads/4478928/normal_6054f9eb5d2b3.pdf
- https://cdn-cms.f-static.net/uploads/4377679/normal_606ea2f4535bc.pdf
- https://xipakopubax.weebly.com/uploads/1/3/5/9/135966228/81713ed789.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/87772e93-bcf7-4983-bfbb-95ce38b73539/numeros_divisores_de_1224.pdf
- https://uploads.strikinglycdn.com/files/06e067dc-4ce7-47ce-a0ec-4f798dc0954b/lezeda.pdf
- https://uploads.strikinglycdn.com/files/21fe48dc-9430-46ed-995e-ef7ae0cc2814/74262699459.pdf
- https://uploads.strikinglycdn.com/files/a5e590c1-025a-4639-b5f0-9540b0c92de8/6277900143.pdf
- https://uploads.strikinglycdn.com/files/69d59f93-230a-45c8-8cae-072d79d4d07a/kupizo.pdf
- https://uploads.strikinglycdn.com/files/37fe5915-9cdd-4d9f-839c-b40428a46e7e/how_to_write_a_business_writing_sample.pdf
- https://uploads.strikinglycdn.com/files/7f54fac6-2741-4f0b-98bd-b5d3b006e0dd/how_much_does_navy_federal_pay.pdf
- https://uploads.strikinglycdn.com/files/38ed29f0-9178-4c3b-8161-f6a10400091a/optimate_4_dual_program_battery_charger.pdf
- https://uploads.strikinglycdn.com/files/4dd67ded-0f12-47c7-a0e1-206efcdd6582/design_thinking_stanford_coursera.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e033.bin547e52752ddcab16fac9c0ef6c4b9b8eed4f5249905fe5707de74ee529746ba4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE033 | 4924 bytes |
font_01_sfnt_off0000f10b.bin076f67e7e3e704f984690b0b4505842118c14947c68b38bd12ca96640f5e8b2c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF10B | 12148 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.