MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links, with one prominent link pointing to 'https://chcial.ru/pbw?utm_term=gulebagavali+song+mp3+download'. This URL, combined with the ClamAV detection of 'Pdf.Phishing.Trojan', strongly suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to the suspicious URL, reinforcing the lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://chcial.ru/pbw?utm_term=gulebagavali+song+mp3+download
- https://cdn-cms.f-static.net/uploads/4373983/normal_603fb21a9f52d.pdf
- https://cdn-cms.f-static.net/uploads/4366358/normal_6026f62d92019.pdf
- https://jemusutagutuf.weebly.com/uploads/1/3/5/3/135390091/4402036.pdf
- https://cdn-cms.f-static.net/uploads/4394079/normal_60483eb78ffb1.pdf
- https://static.s123-cdn-static.com/uploads/4420019/normal_600225fc6702b.pdf
- https://cdn-cms.f-static.net/uploads/4476768/normal_6029ddbe762db.pdf
- https://pulijapejupexeb.weebly.com/uploads/1/3/4/0/134041872/noxaxib_rokibu_defuvexu_serukosoxe.pdf
- https://busajivajikiguv.weebly.com/uploads/1/3/1/3/131384407/timuzemubodupo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d63b2fd3-5ca2-4096-9574-430b1b53f1a8/junot_diaz_short_stories_how_to_date_a_browngirl.pdf
- https://uploads.strikinglycdn.com/files/3b335cdd-9eb6-4155-8b7d-13bdb123159b/optiplex_390_specs_i3.pdf
- https://uploads.strikinglycdn.com/files/7a88d657-1670-42b5-849b-ec1f60594d54/how_to_program_a_carel_controller.pdf
- https://uploads.strikinglycdn.com/files/9d767b7f-b0c9-4481-ab14-c99c887fe82b/miller_spectrum_375_cutmate.pdf
- https://uploads.strikinglycdn.com/files/b169bf9a-2e82-4270-8e23-f6511034808a/64732853222.pdf
- https://uploads.strikinglycdn.com/files/97201f69-6466-4ecd-a35f-897777f68596/honeywell_vision_pro_8000_iaq_installation_manual.pdf
- https://uploads.strikinglycdn.com/files/b2b50753-a4a3-4c66-aa01-eb3194c5fb38/how_to_get_a_free_drink_out_of_a_pepsi_vending_machine.pdf
- https://uploads.strikinglycdn.com/files/6c5a0b05-5aa8-4050-aaa6-d2758956015b/lovuw.pdf
- https://uploads.strikinglycdn.com/files/a69092f3-cbbc-41de-831c-cd8e1878a690/96188599926.pdf
- https://uploads.strikinglycdn.com/files/85474bd7-445f-4e59-86f0-32428bacd4ec/is_harry_potter_on_amazon_prime_canada.pdf
- https://uploads.strikinglycdn.com/files/7bc5e7e3-d1c0-46fa-947f-4ffad1d81047/sears_outlet_washer_and_dryer_sets.pdf
- https://uploads.strikinglycdn.com/files/61b8401f-18db-4e21-a77b-48a97c6c1f77/nogilafav.pdf
- https://uploads.strikinglycdn.com/files/06463798-40cb-4534-97c9-b37ac45c8edd/65416554038.pdf
- https://uploads.strikinglycdn.com/files/66351869-67c9-42f4-9c89-ceda370b7081/92053691145.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb33.bin89700e5ab308c61faa7b97506228179b42951b4d791a9de3b14298ba8ccb0293 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB33 | 5668 bytes |
font_01_sfnt_off0000fe7b.bin0dce7c772191424b760a03bef6512c0a94947758e10bf3b535f2ad77dd2f129a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE7B | 10744 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.