MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic firings reveal a PDF link farm containing numerous external URLs, with one prominent URL being https://zajinet.ru/strik?utm_term=good+books+to+read+for+young+adults+2019. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content. The presence of a link farm suggests an attempt to manipulate search engine results or redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=good+books+to+read+for+young+adults+2019
- http://tramlaweq.online/32596233049xkemq.pdf
- http://totalcreditcheck.info/multiplication_tables_from_1_to_30_free_download03sya.pdf
- https://sowurudiz.weebly.com/uploads/1/3/1/4/131438308/velowubelorilo-vumupavodosoger-wiwavarinufuxit.pdf
- https://midusafamiriron.weebly.com/uploads/1/3/4/7/134702540/fc9ca69fc.pdf
- http://moneyindia.site/what_does_the_left_side_of_my_brain_controlk0cbh.pdf
- https://cdn-cms.f-static.net/uploads/4464521/normal_5fe634f868842.pdf
- https://static.s123-cdn-static.com/uploads/4446027/normal_5fca297a9465c.pdf
- http://alcexpress1.xyz/is_enochian_an_actual_language60t1a.pdf
- http://crawlmqyu.space/66518705261d92il.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/cd526d6b-198b-4045-a65d-d5c4268ee2d1/rekapovulomikudibuja.pdf
- https://s3.amazonaws.com/rovikibixu/ib_biology_mesocosm_lab_report_example.pdf
- https://uploads.strikinglycdn.com/files/4c6095d5-73f3-410c-b109-37d038d1fbb2/how_to_change_celsius_to_fahrenheit_on_safety_1st_ear_thermometer.pdf
- https://uploads.strikinglycdn.com/files/1a45145e-1f5e-4a2a-a28c-5ce41a549509/crosley_dansette_bermuda_vinyl_record_player_review.pdf
- https://s3.amazonaws.com/woneketelak/english_grammar_in_use_raymond_murphy_app.pdf
- https://uploads.strikinglycdn.com/files/99d32223-3b9f-4062-b2ef-2894a4a2887a/is_there_a_single_shard_movie.pdf
- https://uploads.strikinglycdn.com/files/8d37b0b8-0a9d-4315-ad34-98d90321ddfc/vafapadakilefugonokema.pdf
- https://s3.amazonaws.com/lorerexeg/historias_da_carochinha.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015c0b.bin54c72da66d130643852a7a57da056c1909cb2557a0eac0be27dea2b7078e4901 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15C0B | 5728 bytes |
font_01_sfnt_off00016fb1.bin1f2c99e64042f85b7f63d4e7706fef87e3e7f3862559b4c7075f23c58ec15a70 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16FB1 | 10932 bytes |
font_02_sfnt_off0001949c.bind1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1949C | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.