MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document contains numerous embedded URLs, many pointing to disposable hosting, suggesting a link farm designed to redirect users to malicious content. The primary URL, 'https://zajinet.ru/award?keyword=metales+alcalinos+propiedades+fisicas+y+quimicas+pdf', appears to be a lure for academic-related search terms, likely leading to a phishing or malware download page.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/award?keyword=metales+alcalinos+propiedades+fisicas+y+quimicas+pdf PDF link annotation
- http://likefetevu.getenjoyment.net/riwavofilufutisidenoj.pdfIn PDF document text
- http://matawobedopikam.mywebcommunity.org/97549464812.pdfIn PDF document text
- https://cdn.sqhk.co/guwezasov/iaKjfih/samsung_calculator_source_code.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4476294/normal_600517f686d81.pdfIn PDF document text
- https://cdn.sqhk.co/wigalefu/jegdChg/nomanib.pdfIn PDF document text
- https://cdn.sqhk.co/ruperodu/ieghjiX/tekapenogaziwaxawi.pdfIn PDF document text
- http://zuregazezoral.mygamesonline.org/50581626778.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402711/normal_5fdc3c894586f.pdfIn PDF document text
- https://vazaratel.weebly.com/uploads/1/3/4/0/134017227/pedozajediniw.pdfIn PDF document text
- https://cdn.sqhk.co/sesexibanobu/clRIWig/grow_credit_union_brandon_fl.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4494417/normal_5ff5a3c7396e0.pdfIn PDF document text
- https://loniforuwo.weebly.com/uploads/1/3/4/9/134904684/9901331.pdfIn PDF document text
- http://niwizonoleror.mywebcommunity.org/citizen_eco_drive_calibre_8700_manual_set_date.pdfIn PDF document text
- http://fejavodexata.getenjoyment.net/84100611406.pdfIn PDF document text
- https://kepijiloxa.weebly.com/uploads/1/3/4/1/134108658/0c43f3bba21c152.pdfIn PDF document text
- https://cdn.sqhk.co/mobobelelu/eidNJ4v/sapapifuxedunanonoxopam.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473963/normal_6021a2d8f198f.pdfIn PDF document text
- http://xubanapirobula.mypressonline.com/gepaliwonupej.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4c1ba2d6-5827-4965-bb5e-60bc6f56a215/how_do_you_calculate_a_15_tip.pdfIn PDF document text
- http://fozozip.onlinewebshop.net/mahalakshmi_ashtakam_lyrics_in_telugu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce390d67-6a91-4803-bb8b-787023ea5ac6/luxebavesasoloxosagane.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d13fbc3-b85a-493e-b56d-0f0d7e388661/lapuzivoja.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d372a12d-ce3b-4281-a1cb-20c5615c5d05/is_bose_soundsport_free_compatible_with_android.pdfIn PDF document text
- http://kitilogokufalu.atwebpages.com/zifetopezivumitepug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5c43e95c-ee59-469c-9bde-2110c2628e24/how_to_advertise_a_small_business_on_social_media.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efe6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFE6 | 5532 bytes |
SHA-256: c625486b2e73acb739acc30a192065c6e6572b99db1daf9d4c1d03d8c2058d80 |
|||
font_01_sfnt_off000102bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102BB | 11492 bytes |
SHA-256: 33ee6e807319cd3b3cf713776f16af9b9f7eb5437b3625691c0bcc848dd983ec |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.