MALICIOUS
144
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple heuristics indicating a phishing lure, specifically an image linking to an SEO redirector for a 'free download'. The primary URL identified, 'https://zajinet.ru/award?keyword=excel+and+succeed+biology+book+3+pdf', is associated with this phishing attempt. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', further confirming its malicious nature. No scripts were extracted, but the overall pattern suggests a spearphishing attachment designed to lead users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9895
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/award?keyword=excel+and+succeed+biology+book+3+pdf PDF link annotation
- http://kolagozisil.mywebcommunity.org/longman_academic_reading_series_4_answer_key.pdfIn PDF document text
- http://xoroketogejuxe.mywebcommunity.org/84664619805.pdfIn PDF document text
- http://gloslides.com/rancilio_silvia_v6_e_2020_latest_edition_test07az9.pdfIn PDF document text
- http://youralteragoods.com/buy_activated_carbon_filter_sheetwzmti.pdfIn PDF document text
- http://instasurprise.online/chronological_order_of_marvel_movies_imdbsv38s.pdfIn PDF document text
- http://huaweistoreukr.xyz/juicio_de_identidad_de_persona4go1r.pdfIn PDF document text
- http://nakanilo.club/infamous_iron_man_funko_pop_release_dated0y6x.pdfIn PDF document text
- http://lp-consalt.ru/wbpsc_exam_criteria9irlp.pdfIn PDF document text
- http://vanlit.ru/ecology_and_societyatdjg.pdfIn PDF document text
- https://tavabaxo.weebly.com/uploads/1/3/1/0/131071290/xujibulonavipuw-pazotosuwiba-zaxelir.pdfIn PDF document text
- https://rinuvimasajef.weebly.com/uploads/1/3/2/6/132695862/nedazofivazusikotu.pdfIn PDF document text
- http://fawikenaxalu.scienceontheweb.net/xorowetokil.pdfIn PDF document text
- http://verefdliyvtorogo.xyz/harga_revenger_x_kit_vapek1xpc.pdfIn PDF document text
- https://vemisalisak.weebly.com/uploads/1/3/1/4/131437925/2723281.pdfIn PDF document text
- https://kofoxutekibefa.weebly.com/uploads/1/3/1/4/131454286/1939172.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/14081589-149e-46d3-b667-9473fbf541ea/jawajadegufiwup.pdfIn PDF document text
- https://6b54b0b2-91db-43cc-88c8-bbc4f7e20b37.filesusr.com/ugd/a773aa_43046551bf1a433786165931b93e6545.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f1437dbf-cf6f-4c98-84ba-1d52006a5e91/zisovadagubolov.pdfIn PDF document text
- https://d5aacb37-8766-4234-9cc8-c2ec3b911aba.filesusr.com/ugd/1e723b_5e0d54645c5845598a2b1bd4bb530c55.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/af1b5fb2-6afb-4693-9f6f-834037a08b7c/29769702976.pdfIn PDF document text
- https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_b75a50ba83e643ebb12c9b4ab931a0e9.pdf?index=trueIn PDF document text
- https://7ae52be2-ba3c-41fb-8935-29281088223e.filesusr.com/ugd/affaa6_4bae749f956d49a08f5941f0a57ce200.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cd294fd5-625d-4f14-b628-ab8da7848a56/moon_river_guitar_chords_in_f.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00035be9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x35BE9 | 5720 bytes |
SHA-256: 3611ca47fdf3cadd52b339b2b1aef96f3ad329f3d8b27896c658ad320a188d0e |
|||
font_01_sfnt_off00036f93.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x36F93 | 12564 bytes |
SHA-256: 89559fbc68faa2372a9c635ba15273104aef64edeb6df7ebe3e0e79da8958b8c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.