MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable hosting services, suggesting a link farm designed to redirect users to malicious sites. The presence of external URIs and the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic indicate a strong intent to direct users away from the current document. No scripts were extracted, but the overall structure and heuristics point towards a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=how+to+buy+index+stocks+in+india PDF link annotation
- https://lefasibemaji.weebly.com/uploads/1/3/4/5/134589759/topufosoz.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469350/normal_602f0c228e143.pdfIn PDF document text
- https://jedawakebikota.weebly.com/uploads/1/3/4/7/134715316/6a144.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367297/normal_5fe6b295a7d93.pdfIn PDF document text
- http://omynutural.space/bostitch_sb-_1664fn_manualr6fcs.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404725/normal_60688f939b04a.pdfIn PDF document text
- https://tababara.weebly.com/uploads/1/3/0/7/130739165/6797623.pdfIn PDF document text
- https://cdn.sqhk.co/wuvidomanale/b9ih91A/primary_color_wheel_hair_coloring.pdfIn PDF document text
- http://itanto.space/wutuvovazuxozebh4zg.pdfIn PDF document text
- http://iglivesupportteam.com/baxaxemidelaburuwiturofew3uifv.pdfIn PDF document text
- https://cdn.sqhk.co/gidetixi/gehdjeA/major_mayhem_mod_apk_happymod.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468554/normal_605eeffb8977b.pdfIn PDF document text
- http://detonic-ro.website/mewed_noun_synonymvchr8.pdfIn PDF document text
- https://cdn.sqhk.co/luwiwaduna/AjjHJWL/veriso.pdfIn PDF document text
- http://shothard.site/company_of_heroes_2_review_2018x8whj.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4484814/normal_5fe562453a382.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/581daf26-af0a-4f59-a91e-41baae931993/is_home_alone_on_netflix_or_hulu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8edabc7e-4400-4849-a712-b14ebe4d87c5/polk_magnifi_mini_soundbar_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53f86fbe-7825-4a9a-80a8-1fbdcb61ffa5/86239415705.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9df60ede-8313-4ce9-863d-83db756b449b/jesofo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/119f2de2-cb52-493a-b047-1e59075e654d/63857909199.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6919f73-94a2-4ff4-a42b-9a5911df38e7/buralunelijesifub.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000102fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102FB | 5232 bytes |
SHA-256: a623e06831b31a843af1dbc5f539322f686146acb9d6331af1216e56d6289d96 |
|||
font_01_sfnt_off000114f5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114F5 | 10616 bytes |
SHA-256: 82fad36cdb16a2af75e0ee9f085b8d7e17f22ad716f1ed0fc7d9d550d345ea56 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.