MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript, a common technique for delivering malicious content or redirecting users to malicious websites. The heuristic firings and numerous external URLs, many hosted on disposable domains, strongly indicate a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.7925
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://irlanc.ru/uplcv?utm_term=dna+structure+and+function+worksheet+ap+biology PDF link annotation
- http://mlsconsulting.net/cms/files/File/79962347108.pdfIn PDF document text
- https://faresaldabbous.com/uploads/file/24211663585.pdfIn PDF document text
- http://ferramentabelleggia.it/public/file/98317912188.pdfIn PDF document text
- http://eko-uklid.com/files/file/ninanivomop.pdfIn PDF document text
- http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/33864e11ef52446eae40686995233eb9/kawerimixexe.pdfIn PDF document text
- https://illustrations.noche.fr/images/files/61192490658.pdfIn PDF document text
- http://xn--or3bo5mvlb.com/data/editor/file/3259869710.pdfIn PDF document text
- http://gocchame.vn/app/webroot/img/uploads/files/wubavisovebowuxinamarowa.pdfIn PDF document text
- http://www.firengo.com/userfiles/files/gopuf.pdfIn PDF document text
- https://receptabc.hu/images_banner/files/viginozepimivotogusexu.pdfIn PDF document text
- http://www.gpkoaee.ru/ckfinder/userfiles/files/patoroluwepaf.pdfIn PDF document text
- https://maxlinder.com/admin/assets/ckfinder/userfiles/files/lutovonexobibizero.pdfIn PDF document text
- https://0922.sproname.com/files/userfiles/files/xopulawolem.pdfIn PDF document text
- https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136878229fd8---24081152366.pdfIn PDF document text
- http://tomasmrazek.cz/userfiles/file/80230453077.pdfIn PDF document text
- https://hebatkeren88.com/contents/files/80432954748.pdfIn PDF document text
- https://marlin-aquarium.ru/ckfinder/userfiles/files/famokix.pdfIn PDF document text
- https://imad0c0.com/js/ckfinder/userfiles/files/48704985704.pdfIn PDF document text
- https://cafesca.mx/ckfinder/userfiles/files/53717365979.pdfIn PDF document text
- http://tajilin.com/upload/files/41365102939.pdfIn PDF document text
- http://vln.nl/files/file/73620408216.pdfIn PDF document text
- http://vivo-mebel.ru/upload/file/40578577118.pdfIn PDF document text
- http://nicenpos.com/userData/board/file/89983050740.pdfIn PDF document text
- http://phuketdriveschool.com/userfiles/file/ruminufuluzutosaj.pdfIn PDF document text
- http://iwayman.com/uploadfiles/file/210914021724742781tuja1k.pdfIn PDF document text
- https://betenagro.com/sites/default/files/file/rebefugodolikupuwaf.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fd0d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD0D | 11432 bytes |
SHA-256: 3788c234cbbb1d24c3d48a4f59fd3b7a5ee4183ade584f71c7b8535344f46766 |
|||
font_01_sfnt_off000117ab.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x117AB | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.