MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains heuristics indicating it is a link farm and has been flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a site that appears to be a lure, disguised as a PDF related to decision making. While no scripts were explicitly extracted, the PDF structure and URL suggest an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.
Machine Learning
- Nyx PDF Classifier malicious score 0.9524
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/award?keyword=decision+making+and+problem+solving+pdf+ias
- https://lobovalosidim.weebly.com/uploads/1/3/1/4/131437181/kilomirixegisaresu.pdf
- https://vobudogekatobef.weebly.com/uploads/1/3/0/8/130874620/wenawuwi-vanonogekusogen-dozibonosu-gadezepokin.pdf
- https://furamakivagoj.weebly.com/uploads/1/3/0/8/130814247/4751074.pdf
- https://besajiti.weebly.com/uploads/1/3/1/8/131856076/japexewuvupo_kuvezuxev_gemuregivu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://mawabubobiniz.rf.gd/83975417396.pdf
- https://s3.amazonaws.com/kizugokofo/toyota_camry_seat_covers_walmart.pdf
- https://s3.amazonaws.com/lemefofutomapox/android_auto_mazda_cx3_2017.pdf
- https://s3.amazonaws.com/setaxilitozuko/lapilopataleto.pdf
- http://puwomuf.rf.gd/bose_qc35_ii_firmware.pdf
- https://s3.amazonaws.com/wakuzidi/dark_souls_3_dlc_walkthrough.pdf
- https://uploads.strikinglycdn.com/files/30c70ab1-b946-4b41-8672-588ba9fed3a9/how_to_test_gm_oil_pressure_sensor.pdf
- https://s3.amazonaws.com/dazinibonofobi/best_family_calendar_app_for_android.pdf
- https://s3.amazonaws.com/midipes/xezegatupedosemapetirap.pdf
- https://uploads.strikinglycdn.com/files/82624297-566c-437f-8c20-0ba79651b9fd/zapixusupik.pdf
- https://s3.amazonaws.com/gadumagabusodel/manual_qa_analyst_jobs_near_me.pdf
- http://xakarukuneki.rf.gd/kozukikosefuvi.pdf
- http://natunolujekusi.epizy.com/ruzukojegexani.pdf
- https://s3.amazonaws.com/fefurorobumi/scienze_degli_studi_umanistici_e_della_formazione.pdf
- https://uploads.strikinglycdn.com/files/0791b1c0-6857-4262-9297-e84a3b8efead/what_are_the_trending_songs_right_now.pdf
- https://s3.amazonaws.com/foneniz/avadh_university_ma_private_form_online.pdf
- https://uploads.strikinglycdn.com/files/bb9a43f8-2171-4cdb-bed6-93bee086d3d0/tone_of_poem_if_i_were_lord_of_tartary.pdf
- https://s3.amazonaws.com/jajuzasalikirut/ap_biology_chapter_24_easy_notecards.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ffe2.bin6987b17b8c171ff58ad74421a2643466b8abe32284664ac911d6fcf103d958ef |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFE2 | 5736 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.