MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains multiple external URIs, with a primary suspicious URL pointing to a domain known for distributing malicious content. The document body, though heavily obfuscated, appears to be a lure related to '3rd grade english worksheets printable', suggesting a social engineering tactic to entice users to click the embedded malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=3rd+grade+english+worksheets+printable PDF link annotation
- http://academic-club.ru/24996926311u8d9h.pdfIn PDF document text
- http://fionainthefield.org/maytag_window_air_conditioner_model_m7x05f2a0zw12.pdfIn PDF document text
- http://vijuziruzunubiz.iblogger.org/social_media_and_their_founders.pdfIn PDF document text
- http://dabobez.22web.org/19031211762.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bewibiwat/rurezoloroz.pdfIn PDF document text
- https://d09251a9-b09e-4077-8ccb-24037f005f7b.filesusr.com/ugd/a6ce17_4c3398bc310248ba953cf1e9006ade68.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/68108dc3-4c5f-421e-b122-3386be01967f/gepuxogugifelitedunolide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a27de6e9-e4b7-4727-a401-4dc3c3f0d821/fuvepusivokon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d38b09bf-add8-4831-b47e-0744f6821938/calvin_and_hobbes_books_in_order.pdfIn PDF document text
- https://6e345194-e688-4037-aa24-2ff230a16836.filesusr.com/ugd/ce9fe1_cd9c69878475486c926eedb7f7f454e0.pdf?index=trueIn PDF document text
- https://8d6920c1-aef5-45ed-b1a0-e693d63948fb.filesusr.com/ugd/0a593f_16ccd124f0404af18142b449dd83b3b9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8b8fbab0-dc37-4360-b4c9-b782b8c9f026/tipos_de_fichas_tecnicas_de_productos.pdfIn PDF document text
- https://c827806f-f9bf-4fd3-a4ce-e487c020fa79.filesusr.com/ugd/6fd45c_912c95c666ae4fccb674a21e09f60a9e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ad5632e1-6d81-465b-bfd2-b6172e4686b6/farosij.pdfIn PDF document text
- https://s3.amazonaws.com/gifojuxaxeva/85173472175.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4acd2cb-b075-4df6-8a50-8dd8ee4bbb0b/58564619368.pdfIn PDF document text
- https://s3.amazonaws.com/pirofopafu/android_10_samsung_galaxy_note_8.pdfIn PDF document text
- https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_223dfc0ab8474d5090a0fd958805aead.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tobito/how_do_you_prove_parental_alienation_to_a_judge.pdfIn PDF document text
- http://kotorewijog.epizy.com/giwulewoza.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9910752e-c509-45b8-b660-9cf1a7b14764/dialectical_journal_entries_for_the_great_gatsby.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e39c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE39C | 5584 bytes |
SHA-256: 49fdea85e95307281b22472fd6ed985c3fa9a0f5ea0f83cdc1e205cbdc3dabf4 |
|||
font_01_sfnt_off0000f699.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF699 | 10816 bytes |
SHA-256: 7e30d740e06707ac893453d5dc65498a574e4fa229b9bbb7940970be9603d59b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.