MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that mimics a search result for a specific product error, aiming to trick users into clicking it. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for such lures. While no scripts were explicitly extracted, the presence of embedded URLs and the ML classifier's high confidence score suggest a malicious intent, likely for phishing or to download a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/strik?utm_term=kenmore+elite+he3+washer+f02+error PDF link annotation
- https://cdn-cms.f-static.net/uploads/4503387/normal_604d300a129d2.pdfIn PDF document text
- http://mabay.fun/1286717902437ok2.pdfIn PDF document text
- http://mantenancie.com/nulofulojazerladq6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460066/normal_6007302329e1a.pdfIn PDF document text
- http://talkme-news.info/dabivajebovofafowuvefuz4ynu6.pdfIn PDF document text
- http://secret-empire.ru/24691337920eb4dc.pdfIn PDF document text
- http://vadozawemowo.iblogger.org/koterud.pdfIn PDF document text
- http://copyrighytsupport.com/xapezugonituzuwixuxumrmdtu.pdfIn PDF document text
- http://youtube-subscribes.com/grammar_worksheets_for_university_studentsgp01u.pdfIn PDF document text
- http://fusizexa.22web.org/riwidex.pdfIn PDF document text
- http://zunejabilake.22web.org/nemizakewapo.pdfIn PDF document text
- http://nowtorrentz.com/42251503233765za.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://4fcc26ae-a476-48f2-98aa-cdc5c12f4544.filesusr.com/ugd/32d0e1_b9dd6b7cbbdf4e0dba92e16d5a2bbdb0.pdf?index=trueIn PDF document text
- http://zidezogopezir.rf.gd/basic_engineering_circuit_analysis_solution_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fbcf0aed-81d5-4234-8b4e-2f71c96d22ad/wakijanodafezeke.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0980fcfd-a2c2-4c08-a815-b3adf93b2b04/19540469921.pdfIn PDF document text
- https://33b7cf8b-1cb2-46d9-9063-17e97cba5e80.filesusr.com/ugd/9edd50_71068a694c314d77a0c38e9951f9876d.pdf?index=trueIn PDF document text
- http://nomapalugaji.epizy.com/97273455959.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/baff8e83-c503-449b-8905-72d59a5e5a55/54495260591.pdfIn PDF document text
- https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_25bd09969b9a4ebeb3698d10806aa6d9.pdf?index=trueIn PDF document text
- https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_5fa3143e477c4e4699843846aecea3a4.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/603427df-b3f6-4641-bd9b-ff2c4b0ac5eb/is_6_figures_enough.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001012f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1012F | 5292 bytes |
SHA-256: b5517fd58eebe615785ba45afec4dbf51bfb323e161118b98ee73621c8790120 |
|||
font_01_sfnt_off00011309.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11309 | 11124 bytes |
SHA-256: d303dbe0b87cca80ac97f4d12c947507591a127d9067137590b631b234c6d128 |
|||
font_02_sfnt_off00013944.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13944 | 4324 bytes |
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.