MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF is identified as a phishing lure due to its image-only nature and a clickable action that directs to an external URL. The primary URL, 'https://jottigo.ru/strik?utm_term=navicat+for+mysql+free+download+for+mac', is suspicious and likely leads to a malicious payload or phishing page. The document also contains a link farm of other PDFs, suggesting SEO-based distribution tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.7209
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/strik?utm_term=navicat+for+mysql+free+download+for+mac
- https://cdn-cms.f-static.net/uploads/4483336/normal_600ea92944d0a.pdf
- https://zogadinarele.weebly.com/uploads/1/3/1/4/131409244/saget-vizobeged-kosorunekotej.pdf
- https://cdn-cms.f-static.net/uploads/4426677/normal_60362d098da3b.pdf
- https://pofekivivefuron.weebly.com/uploads/1/3/5/3/135339802/zigudafefagejeme.pdf
- https://cdn-cms.f-static.net/uploads/4481540/normal_6060584200970.pdf
- https://static.s123-cdn-static.com/uploads/4459916/normal_5fe2c7f698070.pdf
- https://static.s123-cdn-static.com/uploads/4530868/normal_5fedcaeb93442.pdf
- https://mukoxawav.weebly.com/uploads/1/3/4/6/134627731/c1a32e.pdf
- https://static.s123-cdn-static.com/uploads/4490547/normal_5ff3c45bb980c.pdf
- https://bunonosuvon.weebly.com/uploads/1/3/5/9/135976801/vejesotazem.pdf
- https://moxeguzivega.weebly.com/uploads/1/3/5/9/135965209/kegezorovelito.pdf
- https://s3.amazonaws.com/lixisariwulo/54139291749.pdf
- https://uploads.strikinglycdn.com/files/27a70e2c-0321-4ac1-a90f-122c4060dbf5/evinrude_etec_90hp_service_kit.pdf
- https://s3.amazonaws.com/jivala/best_ad_blocker_android_2018.pdf
- https://s3.amazonaws.com/xufoxorog/bukoxuxipibutozoxuba.pdf
- https://uploads.strikinglycdn.com/files/d510db6a-f952-42cf-bca5-a25fea9cc19c/pantone_formula_guide_coated_2020.pdf
- https://s3.amazonaws.com/wixamupelinere/92713069765.pdf
- https://s3.amazonaws.com/zomuzigo/dapowuwavowutakevagofarar.pdf
- https://s3.amazonaws.com/xufaxoferugod/percy_and_annabeth_sleep_together_fanfiction_rated_m.pdf
- https://s3.amazonaws.com/tanapilamaxi/physics_principles_and_problems_chapter_9_answers.pdf
- https://s3.amazonaws.com/gupawupigawono/67325769987.pdf
- https://s3.amazonaws.com/sazariwapa/jevetosuwofakexa.pdf
- https://uploads.strikinglycdn.com/files/ea71a355-16ef-4f17-8d57-753c12154f75/zesixenub.pdf
- https://s3.amazonaws.com/netinuwa/mozovanimosazituwu.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.