MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous embedded URLs, with a prominent one pointing to 'golowaki.ru' and another to 'jobs-ingenieur.best'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery. The document body, though heavily corrupted, suggests a lure related to appliance repair, which is a common tactic to trick users into visiting malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9986
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=how+to+fix+maytag+2000+series+washer+agitator PDF link annotation
- http://jobs-ingenieur.best/tofawogeweg2e88e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388611/normal_5ff57f5bcb943.pdfIn PDF document text
- https://bazifimu.weebly.com/uploads/1/3/4/6/134661545/jonirij-runibibajoles-kenafi-zaxovavawul.pdfIn PDF document text
- https://famotufenimuz.weebly.com/uploads/1/3/4/1/134132127/repojuxiketepum_petevuke_rofeluwubib.pdfIn PDF document text
- http://1xbet-football.fun/fedapudinodoziowgd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451950/normal_6015a1684084a.pdfIn PDF document text
- http://miiliioner.xyz/vosidixaswdywp.pdfIn PDF document text
- http://bunnygummy.ru/1304103841360ztl.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470532/normal_5fe2bd15869ad.pdfIn PDF document text
- https://duraxotiparukog.weebly.com/uploads/1/3/0/7/130776433/menem-forugovorimim-wofudofi.pdfIn PDF document text
- http://sellamorem.com/pt_sans_caption_bold_font_free9aiax.pdfIn PDF document text
- https://fukaxoxatu.weebly.com/uploads/1/3/1/4/131438517/xilokij.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374860/normal_601ed14a2975d.pdfIn PDF document text
- http://alcexpress1.xyz/saucony_guide_iso_womens_purpled9lx7.pdfIn PDF document text
- http://missunik.space/brian_darnell_hoonigan600zi.pdfIn PDF document text
- http://tacfitproducts.com/carx_drift_racing_lite_apk_para_hilesi2is34.pdfIn PDF document text
- http://community-day.ru/zajeburudutakukuxokohnzof.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4498868/normal_6014b98c105be.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/8d9de6a5-3a4f-4a1d-b674-697be6146422/40153026448.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6cac19bd-a048-4bea-ad81-14054e188f13/webasto_heater_code_f00.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/88a49cd8-6756-4abe-a7a6-964621355acf/rajabetaluruxow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a1bcbb4-ad8e-45f6-bda1-1780f3f3c102/6698397218.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d51dca43-38a4-434a-a243-b04361e3a6fd/90691548.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6676d61b-e2c8-49ea-8694-f4b7ed21be4b/mozizaxum.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000143f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x143F0 | 5328 bytes |
SHA-256: 7d9bd81f37e486891543c9cb4da40208897648e20dd91231c138a8f02a837720 |
|||
font_01_sfnt_off00015628.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15628 | 11136 bytes |
SHA-256: 130761575a279a87ef01a5db4096559be3b38f6f60962c60f24e028a1a3cf1a0 |
|||
font_02_sfnt_off00017c12.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17C12 | 4324 bytes |
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.