MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are on disposable hosting or redirectors, indicating a link farm designed to distribute traffic. The primary URL, zajinet.ru, is associated with a phishing lure related to an employee handbook. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=kindercare+employee+handbook+2019 PDF link annotation
- https://xatomurukazaj.weebly.com/uploads/1/3/4/3/134378662/malapupurilivaxamoli.pdfIn PDF document text
- http://suvuxivenorum.mypressonline.com/who_pays_the_settlements_on_judge_judy_show.pdfIn PDF document text
- https://vopezewom.weebly.com/uploads/1/3/3/9/133988608/2847543.pdfIn PDF document text
- http://future-techno.ru/9053497412258f35.pdfIn PDF document text
- http://hisgohar.site/fire_and_water_restoration_technician_salarynnz20.pdfIn PDF document text
- https://fatuzolawodazu.weebly.com/uploads/1/3/4/7/134730183/pukilon.pdfIn PDF document text
- http://marketitaly.info/classical_music_criticax89h.pdfIn PDF document text
- https://jewinovezuxumat.weebly.com/uploads/1/3/1/4/131407424/felok-pifeserir-vufov.pdfIn PDF document text
- http://topcreditreport.info/ps4_gold_headset_not_recognized147b8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fa380fa2-2f7d-4758-bcb1-1e8ce0135ca9/vabiv.pdfIn PDF document text
- https://s3.amazonaws.com/rezugekolaba/ti-84_plus_c_silver_edition_charging_cord.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a31453ca-e369-456a-8611-d1c5ecd22724/kusofunorigewezofego.pdfIn PDF document text
- https://s3.amazonaws.com/vutame/zizinipeduxanuvoz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32a1ba92-2fa7-405a-9ef0-1627e26fc24f/70270274322.pdfIn PDF document text
- https://s3.amazonaws.com/dewutexorob/mesevekitewuwam.pdfIn PDF document text
- https://s3.amazonaws.com/xujitezu/como_fazer_um_resumo_profissional_para_currculo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ed778f3-3965-4451-86db-14a4af05b235/is_madame_bovary_hard_to_read.pdfIn PDF document text
- http://novogizeboje.myartsonline.com/68549757648.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d35827b-4d23-478a-a937-fe4a470acb3b/68636352632.pdfIn PDF document text
- http://wurebosuloxu.myartsonline.com/68356671754.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/687e6006-d060-44e3-95ff-a2e4fd46f7e6/goffman_the_presentation_of_self_in_everyday_life_amazon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/584c867b-7f84-4632-8bbf-cd3e9a5ae3d9/29192742060.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e80a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE80A | 5892 bytes |
SHA-256: cf0727eeac58d668a49cace0a8905bf9ea8275d4f422d742f9cbd96307617a14 |
|||
font_01_sfnt_off0000fbf3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBF3 | 10788 bytes |
SHA-256: dd4ac2c48b409da0e981f3994e468e890dd2fe48548e740634badf6206f2e01e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.