MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document functions as a link farm, directing users to numerous external websites under the guise of search results. The primary URL, 'https://zajinet.ru/wix?keyword=ideal+gas+law+worksheet+with+answers+pdf', is presented as a relevant result, but the document's structure and the high number of distinct external links suggest a malicious intent to drive traffic to potentially harmful sites. The ML classifier and ClamAV detection strongly indicate malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/wix?keyword=ideal+gas+law+worksheet+with+answers+pdf PDF link annotation
- http://gililofus.medianewsonline.com/assamese_news_paper_download.pdfIn PDF document text
- https://mibakadediwo.weebly.com/uploads/1/3/4/5/134584598/xirudulajaduruzi.pdfIn PDF document text
- https://bigudiwox.weebly.com/uploads/1/3/5/3/135304820/begenif-ruteris-movixodegegu.pdfIn PDF document text
- https://savibivo.weebly.com/uploads/1/3/1/3/131381036/jekoser.pdfIn PDF document text
- http://juwaniwabi.medianewsonline.com/nutricion_parenteral_en_pediatria_2020.pdfIn PDF document text
- https://vefekigut.weebly.com/uploads/1/3/4/3/134391246/b3917bb82028fa5.pdfIn PDF document text
- https://gagaxezoxi.weebly.com/uploads/1/3/4/7/134760548/fovaniven.pdfIn PDF document text
- https://dodanopo.weebly.com/uploads/1/3/1/4/131408738/2884543.pdfIn PDF document text
- https://kenojitoxudu.weebly.com/uploads/1/3/1/3/131383977/3164521.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jagux/botnica_geral_wilhelm_nultsch.pdfIn PDF document text
- https://e474413f-ff6d-4b46-a00c-d4c33541206b.filesusr.com/ugd/ddecc0_a926fdf10430433b93bff409b6b877ca.pdf?index=trueIn PDF document text
- https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_ec43aada6acf4a18a77d2ff02e9a45c9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/seriposuj/whirlpool_gold_quiet_partner_iii_control_board.pdfIn PDF document text
- http://dufojamimusim.atwebpages.com/stock_market_guide_for_beginners.pdfIn PDF document text
- https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_24067bf228ac43e486b95978f955ea63.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vofadoloves/74808013846.pdfIn PDF document text
- https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_2a32d4ea56d84078b7e23a2cbd1fbf1b.pdf?index=trueIn PDF document text
- https://aee666f7-65d2-4416-8089-42e5bd85255d.filesusr.com/ugd/c4036c_53c2cdb70e074ce199298635c3aa0b7f.pdf?index=trueIn PDF document text
- https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_6c6adf0ed9a14c0ca6198ff37b30a597.pdf?index=trueIn PDF document text
- https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_8ed640b9f2f341ecb6b1c38d64d8798f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/mogipegi/70413419589.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDCA | 5396 bytes |
SHA-256: 1ae06a569f0165b255be97aa852ab41126ceb127232899182fff6cf4939b97bb |
|||
font_01_sfnt_off00010030.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10030 | 10688 bytes |
SHA-256: d3d3762efd02c9db2d92ce6cb561de1febd887792dd8e0609985a2d04a6c78d4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.