MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with a high-priority heuristic identifying it as a link farm on disposable hosting, specifically pointing to 'http://luminar2-download.xyz/the_gnostic_biblexv3ng.pdf'. The document body, though heavily obfuscated, appears to contain text related to firearm queries, suggesting a lure to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=is+the+ruger+sr22+pistol+a+good+gun PDF link annotation
- http://luminar2-download.xyz/the_gnostic_biblexv3ng.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366055/normal_6043fba3cd19d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4455198/normal_5ff51d84ca495.pdfIn PDF document text
- http://kvadro63.ru/what_to_do_when_your_beats_wont_charge21uck.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446035/normal_60490fc18fa8b.pdfIn PDF document text
- http://pumba-timon.space/breath_of_fire_2_shaman_fusion_guideiolj7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383586/normal_6032979b9ba0f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417675/normal_5ffc209f88e7e.pdfIn PDF document text
- http://ionatr.space/the_drama_of_scripture_summary_book_reviewz97yr.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b09e108a-0d8c-489f-aa33-59925d08e0b3/cuando_es_el_dia_del_trabajo_en_estados_unidos_2020.pdfIn PDF document text
- https://s3.amazonaws.com/fejakixoweka/libro_un_mundo_feliz_de_aldous_huxley.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c1865d3-073a-4d03-99fd-c5002732cfcd/how_to_use_ge_oven.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d37c5903-49c7-4440-b694-bfab34b4573b/how_do_i_make_my_verizon_remote_control_my_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d6ec7b3-297d-4202-85cb-c6fa007eae31/giraffes_cant_dance_book_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eae23795-6817-40cf-b380-e5ae263207d0/what_changed_between_the_old_and_new_testament.pdfIn PDF document text
- https://s3.amazonaws.com/wezukep/72962332096.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7110e52-6a9f-4b92-8b86-2526ad615985/mf_35_starter_switch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd415444-674b-47dc-8833-597c2148aa1c/gk_pal_practical_physiology_books_free_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d8920724-18d0-4c83-a63c-be7b0a22e907/xiguseroruno.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cca6e824-5cdd-44e8-9615-bbc911e8a98e/navy_nec_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/acfc0904-f1f4-4ae4-b290-47eee2a89028/xoxofufiterufawilo.pdfIn PDF document text
- https://s3.amazonaws.com/xalasawu/cours_algorithme_gntique.pdfIn PDF document text
- https://s3.amazonaws.com/xoferuzu/national_cash_register_repair_manual_class_300_700_ncr.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e6e9295-180f-4198-9439-f3541d298a76/desktop_means_in_english.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a94a3f0-34af-493b-ae13-9d1bbcaaf7db/tetazapijulipumugulibozu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011181.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11181 | 5288 bytes |
SHA-256: e93b147722b05b0d2819c37dcbb7c40c546b5d1be2f6dc9046737fba0ff119a7 |
|||
font_01_sfnt_off00012378.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12378 | 11680 bytes |
SHA-256: ab5d653030eda7eb176506df4438a75f697896ae3c38923339365cec36d6e2dd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.