MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to direct users to malicious content. The primary URL, 'https://xajibur.ru/award?keyword=raytheon+atflir+pdf', appears to be a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9714
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/award?keyword=raytheon+atflir+pdf
- https://demavagof.weebly.com/uploads/1/3/4/0/134017100/mojumiziwigonamo.pdf
- http://pawomodom.medianewsonline.com/bujumedimelopi.pdf
- https://velineninebag.weebly.com/uploads/1/3/4/6/134608195/a887781a49c7a28.pdf
- http://toworugesolur.getenjoyment.net/sony_rx100_mark_7.pdf
- https://wobomiti.weebly.com/uploads/1/3/4/5/134501920/3156134.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tixefol.epizy.com/81378079718.pdf
- https://uploads.strikinglycdn.com/files/69495dc9-c9de-4e65-a97f-f45d8cd99c30/can_you_text_on_the_jitterbug_flip_phone.pdf
- http://jatugeset.atwebpages.com/gafubogonixatogi.pdf
- https://uploads.strikinglycdn.com/files/4c73b7aa-26b3-4cb8-a244-e7735eca05e4/fluke_microscanner2_price.pdf
- https://uploads.strikinglycdn.com/files/a759c688-73ce-41d7-9e02-cce66d3b3758/update_patch_sims_4_download.pdf
- http://raxusitusumulag.rf.gd/wanewepelomanimufadakepon.pdf
- http://gajopule.myartsonline.com/61726913566.pdf
- https://7fe6b731-3703-45da-bcbe-faf39b4d3392.filesusr.com/ugd/880a7e_0e066ce31d5848ff98de8d3275441774.pdf?index=true
- https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_0680adcfefa9400482b7f82d1a0238d0.pdf?index=true
- https://b6086c54-8ef4-40f3-ba18-bbbb993b339e.filesusr.com/ugd/36e927_6d0d62765d35487d908406f5ff1259ea.pdf?index=true
- https://fefcf4f0-bf52-4086-adb3-b788df03f7bd.filesusr.com/ugd/da9d4c_06c9088834284910b845bfe17225efb1.pdf?index=true
- https://e49cd12a-7e53-4a25-9f98-ae37b5ff2e44.filesusr.com/ugd/35dc59_bfba51e70d2f4fb5a0bb51185c4ad706.pdf?index=true
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9ad.bine77c953d3cacd9050c9c769f33f9a70282800a49e42f8b898ce9d746d4f468d6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9AD | 5060 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.