MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains numerous external links, many pointing to potentially malicious domains, indicative of a link farm or phishing lure. The presence of 'wkhtmltopdf' and a specific PowerShell command sequence suggests an attempt to execute code or redirect users to malicious sites. The ML classifier and ClamAV detection strongly support its malicious nature, likely serving as a phishing or malware distribution vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=uc+browser+for+pc+windows+10+64+bit+offline+installer PDF link annotation
- https://zanobuxukopul.weebly.com/uploads/1/3/4/6/134678616/kexoluki.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501991/normal_605b93cd860fd.pdfIn PDF document text
- https://dowanudamedi.weebly.com/uploads/1/3/1/3/131398164/59af12af5e5c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422914/normal_601df37af12cf.pdfIn PDF document text
- https://nilozirarita.weebly.com/uploads/1/3/4/4/134463528/5646034.pdfIn PDF document text
- https://rixotojar.weebly.com/uploads/1/3/0/9/130969533/338289.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459917/normal_6030ec6b8fcff.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4475000/normal_6046ea906ad6c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/fejenijovekozu/contemporary_linguistic_analysis_william_ogrady.pdfIn PDF document text
- https://s3.amazonaws.com/fusopoxipo/acer_aspire_a315-_21_manual.pdfIn PDF document text
- https://s3.amazonaws.com/mojivikapeti/hackmaster_5th_edition_gm_screen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89eea2d5-37d8-4f0f-aeba-1054161f9cae/situfipovidexikoxirugobis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/20d33559-506e-4041-bab7-e6e23b3868f8/nisedijabufe.pdfIn PDF document text
- https://s3.amazonaws.com/mubefula/98550061725.pdfIn PDF document text
- https://s3.amazonaws.com/xixonu/51703348223.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c764cca6-6e46-41fb-b331-2f43546a98a1/namaz_e_nabvi_hindi_free_download.pdfIn PDF document text
- https://s3.amazonaws.com/tafogusegabomu/bertrand_russell_philosophy_for_laymen.pdfIn PDF document text
- https://s3.amazonaws.com/lorifumofelu/51653960719.pdfIn PDF document text
- https://s3.amazonaws.com/rilexazejuzovep/how_to_find_the_deed_of_a_property.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55a1c37e-da0c-4a32-889c-1806e048afb9/56886271911.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba1022ec-300f-4c9b-8722-0020706d2873/how_to_prepare_for_a_gmat.pdfIn PDF document text
- https://s3.amazonaws.com/rolefosiju/7893880937.pdfIn PDF document text
- https://s3.amazonaws.com/gizonukorad/magic_bullet_smoothie_recipes_spinach.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edbd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDBD | 5808 bytes |
SHA-256: 88476603a58998d553a8f66649b736cb91664d8ccd28326bc5fe26fbd4e83bd4 |
|||
font_01_sfnt_off000101a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101A9 | 11532 bytes |
SHA-256: 268f44dd40659289bffdcd31aba8c918b878f924eb8f2516e22148289d2dfca3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.