MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains numerous external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious sites. The presence of embedded URLs and the overall structure indicate an attempt to trick users into clicking through to a potentially harmful destination, likely for credential harvesting or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/123?utm_term=avira+registry+cleaner+free PDF link annotation
- https://waluxine.weebly.com/uploads/1/3/4/7/134759732/e6b925b372.pdfIn PDF document text
- https://vekibapovadivoz.weebly.com/uploads/1/3/0/8/130873848/4773319.pdfIn PDF document text
- https://wejuvizir.weebly.com/uploads/1/3/4/3/134395749/8f6f14dd30.pdfIn PDF document text
- https://siluxukazikuwo.weebly.com/uploads/1/3/5/3/135326211/kejoxiniwozax.pdfIn PDF document text
- https://zajinepimasi.weebly.com/uploads/1/3/2/8/132815118/3fd2ad0b78bd.pdfIn PDF document text
- https://nafeziwubiwodi.weebly.com/uploads/1/3/1/3/131379183/nuxujafunegij-dapexix-xufazigeko-vaxiliwalon.pdfIn PDF document text
- https://magijomolalol.weebly.com/uploads/1/3/1/4/131437319/4582554.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8cb18774-6122-4524-bef6-a80288befd09/sabig.pdfIn PDF document text
- http://luwapoveduvi.pbworks.com/w/file/fetch/144487641/bipabi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3192c133-f9e3-4961-9faf-410a4ca8a090/61558497282.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/201e61ea-d2d6-435e-8286-73f25f5cb6bb/love_story_music_notes_piano.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fa8c47b-7c24-4714-9b96-ac6ed08370ee/sivoside.pdfIn PDF document text
- http://togiwuvoze.pbworks.com/w/file/fetch/144470595/problemas_sencillos_de_suma_y_resta_para_tercer_grado.pdfIn PDF document text
- http://visetululiv.pbworks.com/w/file/fetch/144415359/4963700852.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ed8661c-ab7c-461d-8806-756cea95579d/whirlpool_gold_refrigerator_troubleshooting_not_cooling.pdfIn PDF document text
- http://jujupaw.pbworks.com/f/ielts_paper_based_exam_dates.pdfIn PDF document text
- http://mawasuwov.pbworks.com/f/chander_pahar_full_movie_hd_1080p_free_download.pdfIn PDF document text
- http://lulatigono.pbworks.com/f/23935043206.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32c008d9-3a74-4c0b-8dba-0139b0e968b2/pejaxivivela.pdfIn PDF document text
- http://mumubib.pbworks.com/w/file/fetch/144413244/vopekebepoxig.pdfIn PDF document text
- http://minuwaxiper.pbworks.com/f/life_of_pi_quotes_with_chapter_numbers.pdfIn PDF document text
- http://rugewenuzed.pbworks.com/w/file/fetch/144421809/mebozininadinu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e170.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE170 | 5200 bytes |
SHA-256: b38495d41f0a93b0a7bedda3304217f5196afbd6b8d5f577377f9c03d271c2bf |
|||
font_01_sfnt_off0000f344.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF344 | 15912 bytes |
SHA-256: c50e9a8cb264afeb10332c82cf7f2deeb31cfb9a1f8d9caaf2cff5a07c4c4ee5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.