MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link farm with numerous external URLs, including one that appears to be a phishing lure related to car battery lights. The ClamAV detection and ML classifier strongly indicate maliciousness, classifying it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9950
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=what+causes+a+battery+light+to+stay+on
- https://kinifuromokemo.weebly.com/uploads/1/3/5/3/135348191/3802003.pdf
- http://xteenware.online/cheap_baby_g_watches_australiagg4jp.pdf
- http://marketitaly.info/85418994963kgng4.pdf
- http://vanlit.ru/how_to_find_work_as_a_freelance_writer061lo.pdf
- https://jidugurulepapol.weebly.com/uploads/1/3/4/3/134310086/sunibisumaxusap.pdf
- https://gefizubumob.weebly.com/uploads/1/3/4/4/134473977/4606690.pdf
- http://mafeniwaparidip.22web.org/41869825214.pdf
- https://doleroxewaforud.weebly.com/uploads/1/3/4/3/134322791/5195368.pdf
- https://vogaxuruxav.weebly.com/uploads/1/3/4/3/134352923/pimazokugema.pdf
- http://wdd13.ru/241214035939eqhy.pdf
- https://gidiwukos.weebly.com/uploads/1/3/1/3/131381706/7117537.pdf
- https://rirejanumaxix.weebly.com/uploads/1/3/4/6/134631236/2732095.pdf
- http://discount50.pro/1254661407yejit.pdf
- https://jirakeleda.weebly.com/uploads/1/3/5/9/135992973/6270526.pdf
- https://pazisurezufil.weebly.com/uploads/1/3/4/5/134594691/lotetedonuwugubo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_6e1007124e3f49439200a36790fe6fc8.pdf?index=true
- https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_b7b44ced160143cd95e6ceff0c7c5236.pdf?index=true
- https://s3.amazonaws.com/zinudipir/wiravigelawadosomowasade.pdf
- https://4ad55601-b8ab-4ae0-bc0e-e90069072326.filesusr.com/ugd/3aca14_fc9ce414b9174c0c839bb011ecb4e557.pdf?index=true
- https://s3.amazonaws.com/tirimofufemukat/52360823592.pdf
- https://s3.amazonaws.com/xesigeze/23561693734.pdf
- http://fojodopid.rf.gd/7760503676.pdf
- http://matewodupenes.epizy.com/golezuzasagifatapasi.pdf
- http://demuremapinob.epizy.com/xusida.pdf
- https://s3.amazonaws.com/gixawetopoli/nezuzulukasuvokoziduka.pdf
- https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_4278a6e946ed477e946a5d6cdac8182b.pdf?index=true
- http://rirukezuruxemuk.epizy.com/various_synonym_formal.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f02b.bin18c87824954bc563281c81b8c9873fa54f2eb05409abc3418899bc68f7368c53 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF02B | 5200 bytes |
font_01_sfnt_off000101dc.bincc1ec6c1c4628beef4ab69461cfae7bbd425060c2e6aa8c02dd15e7840c5c9c5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101DC | 10132 bytes |
font_02_sfnt_off00012471.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12471 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.