MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan distribution attempt. The presence of numerous external links, including one pointing to 'xajibur.ru', suggests the document is designed to redirect users to malicious sites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports this, indicating a link farm hosted on disposable domains, likely to obscure the true malicious destination. No scripts were extracted, but the overall structure and heuristics point to a malicious download lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=minecraft+mod+chicken+chest+1.+7+10 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4449793/normal_601cc8a7e9168.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4496577/normal_60314b9b5d7df.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370286/normal_60474410213ba.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413363/normal_60354cbfac34c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://lekuzax.pbworks.com/w/file/fetch/144418500/rosovividositubali.pdfIn PDF document text
- http://risoxef.pbworks.com/w/file/fetch/144454407/how_to_breed_llamas_in_minecraft.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f5093a2-b010-4ab3-be2a-820cbd490f41/forklift_training_systems_david_hoover.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55a43525-f53b-47c0-8f85-5bcdb3cb994f/that_hideous_strength_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6585770a-eb18-405f-9c63-b98d4a4cd6fd/vagiwapak.pdfIn PDF document text
- http://kapetipubi.pbworks.com/f/adventure_time_finn_x_huntress_wizard_fanfic.pdfIn PDF document text
- http://zubipuwaf.pbworks.com/f/dozazikatijaxaxola.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ef0d6fa-cd6f-4fbc-ac53-be9a4a4328c3/30470757274.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/562960e3-4fb9-49fa-99f5-954404ad78fa/how_to_replace_a_microwave_handle_ge.pdfIn PDF document text
- http://togiwuvoze.pbworks.com/w/file/fetch/144455472/roblox_level_7_script_executor_free.pdfIn PDF document text
- http://mumubib.pbworks.com/w/file/fetch/144413745/dovosufema.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e3fe887-5ae4-499b-8f01-4a3a8fd8c8fb/jujanivinosepipofeso.pdfIn PDF document text
- http://jizakatum.pbworks.com/w/file/fetch/144496131/dizilikinutalogodidew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c85a3872-6826-4dee-a019-fd022315e91f/72732826587.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/79ab2f3a-6ae4-4d15-a818-94aeb98d4897/50347538481.pdfIn PDF document text
- http://paderukut.pbworks.com/f/63675232119.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/35fe9b16-0dfb-4a91-afc6-0456fdadc07c/myriad_bold_font_free_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00019a51.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19A51 | 5604 bytes |
SHA-256: 87a561fc54ceeea4efff52898294c34a6ebab208199f14b0f1c22e55f24c207f |
|||
font_01_sfnt_off0001ad52.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1AD52 | 9792 bytes |
SHA-256: 792d23fb7669062cea11db3cd9bd7733ff1cee2cfa797085853e25e060bab68b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.