MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, flagging it as a phishing trojan. It contains numerous embedded URLs, many of which are hosted on disposable domains and appear to be part of a link farm, suggesting an attempt to obscure the true destination. One URL, 'https://jumiwimov.ru/123?utm_term=canoscan+4400f+driver+software%252B+free', is directly associated with the heuristic 'PDF_URI' and suggests a lure for downloading software drivers.
Machine Learning
- Nyx PDF Classifier malicious score 0.9973
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/123?utm_term=canoscan+4400f+driver+software%252B+free PDF link annotation
- http://matteset-spon.space/tsa_carry_on_size_jetblue2imjh.pdfIn PDF document text
- https://cdn.sqhk.co/sujutowupolu/ifFhdKN/12860360532.pdfIn PDF document text
- http://jabolemifagafu.22web.org/how_to_learn_laravel_easily.pdfIn PDF document text
- http://gevifavilovaz.22web.org/sentry_safe_lock_box_how_to_open.pdfIn PDF document text
- http://nevujuxol.iblogger.org/how_to_be_a_good_leader_and_manager.pdfIn PDF document text
- http://wiinorama.website/73735878802jxsk2.pdfIn PDF document text
- https://tekagegi.weebly.com/uploads/1/3/2/7/132740997/9449113.pdfIn PDF document text
- https://womominajarizu.weebly.com/uploads/1/3/5/3/135392323/5951718.pdfIn PDF document text
- https://wixotofipexux.weebly.com/uploads/1/3/5/4/135400714/gerakatezukutoj.pdfIn PDF document text
- https://cdn.sqhk.co/towinomer/RR6jjbB/cordless_christmas_lights_with_timer.pdfIn PDF document text
- https://xubafema.weebly.com/uploads/1/3/4/4/134447535/tevirivoro-madogikulorid.pdfIn PDF document text
- https://cdn.sqhk.co/wamamuli/3ohcIia/hachi_hachi_galaxy_mall_surabaya_menu.pdfIn PDF document text
- https://zozolunefa.weebly.com/uploads/1/3/5/3/135325744/d6d723d0.pdfIn PDF document text
- https://cdn.sqhk.co/towevefizub/jbHloja/rogakorulurapew.pdfIn PDF document text
- https://cdn.sqhk.co/xusorawoka/jgehbRm/scribble_rider_game_download_for_pc.pdfIn PDF document text
- http://thecabinets.xyz/business_information_technology_courses_in_canadayvqcz.pdfIn PDF document text
- https://tunibedexorole.weebly.com/uploads/1/3/5/3/135350281/dejufetapopusas.pdfIn PDF document text
- http://debodopox.iblogger.org/14186590283.pdfIn PDF document text
- http://hookup668.site/jejupn9m4j.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://ramasewo.epizy.com/barron_s_ielts_academic_reading.pdfIn PDF document text
- http://fijinibegomiba.rf.gd/goxadora.pdfIn PDF document text
- http://rowesotinik.rf.gd/apache_spark_machine_learning_blueprints.pdfIn PDF document text
- http://ranuvukeguzekiz.epizy.com/the_american_journey_history_book_answers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed8e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED8E | 4604 bytes |
SHA-256: c3a8214ccb8cf23aa6612a48c593259fb9452855c1fb6d2204c0df84505ab9a4 |
|||
font_01_sfnt_off0000fdf8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDF8 | 5268 bytes |
SHA-256: 7aa147f4656a611e60a6069123476ff56772cce8da4c05c02d907cba86cf07e1 |
|||
font_02_sfnt_off00010ffb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FFB | 6148 bytes |
SHA-256: 149738eb3e1d0bfb4a5732e89a115965e6f0cf3fc4971c694d3ce3619176544d |
|||
font_03_sfnt_off00011fda.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11FDA | 14072 bytes |
SHA-256: f92fccd3fe158b19162b1ff3ca582a71b911255b4a308e9f3c512186ee122c8d |
|||
font_04_sfnt_off00014a83.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14A83 | 16684 bytes |
SHA-256: cc86994599ca2b6bade3ef2a24080e5ca7d0105f80c2e61a4a6d43fb5994c661 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.