MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a common tactic for SEO poisoning and phishing. One prominent URL, 'https://jumiwimov.ru/strik?utm_term=kenmore+washer+not+spinning+or+draining', appears to be a malicious landing page designed to trick users searching for technical solutions. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=kenmore+washer+not+spinning+or+draining PDF link annotation
- https://ropexosuwewi.weebly.com/uploads/1/3/1/3/131380205/097a05a.pdfIn PDF document text
- https://dipedupaketi.weebly.com/uploads/1/3/4/3/134333799/9d172929e0aaa.pdfIn PDF document text
- http://getsol.xyz/application_for_solving_mathematical_problemspigwl.pdfIn PDF document text
- http://pitushok.space/which_echo_device_is_best5aj30.pdfIn PDF document text
- http://copyrightshelpcenter.com/561007412494za6a.pdfIn PDF document text
- http://masajsalonunuz.com/516604662493sq4j.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5d89eac8-c107-4e61-b4fb-02a76b9bdff0/wakakubamobulu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/80c15245-ba5b-46bf-8fe5-f1360fd7347f/how_high_are_hurdles_high_school.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cbf07e3e-1cbd-4c6f-b980-8013d86a4161/adventist_home_study_guide_pdf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/35ec7238-0405-4904-9152-c2080543426c/bamifa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/24b71a9a-bee5-42db-9bcb-f9320ebbe75c/pidapujajivopevupi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2936d8f7-cb8d-4732-ba92-b18b1a191189/satobiwotukinelon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b2012ba-4048-4e8c-bc73-aba08efe44e5/44239609124.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/40a9c5fc-ad39-4484-ad79-67d3d1c51326/gupizakonamow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01d9a04d-3911-42fb-86da-a7c51f3cda0a/extrait_camus_le_mythe_de_sisyphe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/949e29cf-2750-43a8-9da1-cd3739501558/53735467132.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/92b1672a-80aa-48cb-adf2-3e66b7462143/importing_journal_entries_from_excel_to_quickbooks_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f803346-aba5-4b98-b910-eb0e66c45e72/hoover_windtunnel_max_uh70600_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f10b2615-7209-4425-b23a-c59b55966c85/rewajematu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d09bb6f2-0961-46b1-98fc-4dede1b80994/hcf-2_transmission_fluid_advance_auto_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8fb32d9b-d318-4f16-bc86-d8bb8f89e064/the_game_show_channel_schedule.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c8bb8a7-387d-4f09-8435-4bd3f396170e/rutazalub.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2c7296e-7f5a-4c09-b070-c3ce4e069887/arnold_mucusless_diet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69253b97-b176-449c-b0b3-7ffc3075ee68/vivozifijujo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42a4c01f-1533-4e5a-8cf4-9a3cdb10424a/78458046361.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000105e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105E4 | 5400 bytes |
SHA-256: cd00dfd91ad65175450056416a96e070b38ecf9d7bde0b4f31c3f38ea76e03b6 |
|||
font_01_sfnt_off0001182f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1182F | 11088 bytes |
SHA-256: d975ab3bb3439c2d1da4528cb1e1c554b32bddbb07b09100591cf0fc2178463e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.