MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a URL that mimics a search result, suggesting a phishing or redirection attempt. The presence of numerous external URIs, many hosted on disposable domains, further supports a malicious campaign aimed at directing users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/award?keyword=surge+protection+device+schneider+pdf PDF link annotation
- http://0fruit.space/punixizipuwutanutepamy4rl8.pdfIn PDF document text
- http://vufajed.getenjoyment.net/wagner_wide_shot_power_painter_spray_fast_plus.pdfIn PDF document text
- http://livecopyrightverification.com/winrar_for_pc_windowssiemj.pdfIn PDF document text
- http://belkwigs.com/tom_and_jerry_willy_wonka_and_the_chocolate_factory_full_movie_download_in_hindivzgqy.pdfIn PDF document text
- http://technodom11.com/henry_cavendish_school_uniform6weso.pdfIn PDF document text
- http://pet-guru.shop/dogonaduzojhtvh.pdfIn PDF document text
- http://getdouche.xyz/derugafajaburef21lsv.pdfIn PDF document text
- http://parkingtest.xyz/pokemon_revolution_online_hoenn_elite_4_guideyro1z.pdfIn PDF document text
- http://lomilinixigal.mypressonline.com/ethics_case_study_with_solution_in_english.pdfIn PDF document text
- http://propovar.ru/coraline_full_book_online_freeiad9e.pdfIn PDF document text
- http://fajufoturesu.sportsontheweb.net/37719028094.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/277c7556-02de-4695-9f07-b96b20588b7e/98810166796.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fe78741-f13d-4250-85f8-0c15140d73d5/porusafujugibolizug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3034ecf8-38c5-4abd-af6e-2f9425525ecb/ninja_auto-iq_pro_extractor_single-serve_blender_with_recipe_book.pdfIn PDF document text
- http://mubewazut.rf.gd/easy_learning_mandarin_chinese_dictionary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc2dd95e-df32-4b74-bbe6-f92dcb6b0fa8/sejofulokojonubifawu.pdfIn PDF document text
- http://nibimasumexugi.rf.gd/13962833580.pdfIn PDF document text
- http://lonozixugixapap.epizy.com/logical_reasoning_questions_and_answers_for_sbi_po.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4d6929eb-e94a-40a8-a00e-826228370afd/begujalazikukiw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4836a59-3cc1-45b5-901f-146ad35b23f8/step_6_worksheet.pdfIn PDF document text
- http://zedebepibepus.rf.gd/excluded_values_worksheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ddeb8f04-1cf6-43b0-a59e-2439364a4314/thermador_range_griddle_cleaning.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7f6436a-7df9-4dcd-9041-5f4a0fb3f7f2/67890200030.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2781fe02-c18b-4660-8f3e-d07fa28b4feb/samsung_printer_c460w_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cd1d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCD1D | 5336 bytes |
SHA-256: 1436b95716924cce2fe1c891fc898396c04e982a5f810d9bb8577430f26babae |
|||
font_01_sfnt_off0000df51.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDF51 | 12700 bytes |
SHA-256: fa1ace734284274f848cb7a48bf2e31a43738ee0f17ab1a4f7e9811335f3ccf5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.