MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many of which point to disposable domains or redirectors, indicating a link farm designed to obscure the final destination. The primary URL, "https://jacksth.ru/strik?utm_term=whirlpool+cabrio+washer+not+draining+or+spinning", suggests a lure related to appliance repair, aiming to trick users into clicking. ClamAV detected this file as 'Pdf.Phishing.Trojan', and ML classification strongly indicated maliciousness, supporting a phishing or malware distribution attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=whirlpool+cabrio+washer+not+draining+or+spinning PDF link annotation
- http://nizavevorupuj.mywebcommunity.org/mass_effect_2_crack.pdfIn PDF document text
- http://topuniversityru.fun/fizurorujepis6y69u.pdfIn PDF document text
- http://eurofamily.pro/773390684349xya5.pdfIn PDF document text
- https://wosefekolejareb.weebly.com/uploads/1/3/4/3/134340916/3ed40dfd0d.pdfIn PDF document text
- https://visuwinewuj.weebly.com/uploads/1/3/1/4/131407241/vamax.pdfIn PDF document text
- https://povilaromegew.weebly.com/uploads/1/3/4/4/134486615/222a729.pdfIn PDF document text
- http://inostrana.com/xezozenajekidibewumekjx2dm.pdfIn PDF document text
- https://lefagetali.weebly.com/uploads/1/3/2/3/132302894/935026.pdfIn PDF document text
- http://tebeririz.scienceontheweb.net/bye_laws_of_society.pdfIn PDF document text
- http://miwasigal.mywebcommunity.org/thoughts_are_things_poem.pdfIn PDF document text
- https://tagekoworiz.weebly.com/uploads/1/3/4/0/134016686/mudogalupuvebo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://2a4065d7-883d-43e8-a524-7ce9aa4b4e88.filesusr.com/ugd/ccb1c6_1532264ed5a546c2a020df53fffde124.pdf?index=trueIn PDF document text
- https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_278c00f6a79d452e9f36af40ceba4b5d.pdf?index=trueIn PDF document text
- https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_07e3556014fb43e7bd22f88d36dfcf26.pdf?index=trueIn PDF document text
- https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_615c8d4a33544abdb0ed6a525fc85074.pdf?index=trueIn PDF document text
- https://41fe7446-7195-45c8-906d-de5e784989f9.filesusr.com/ugd/e02969_27e822dba71048338e70eefbfe9ee52e.pdf?index=trueIn PDF document text
- https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_920fe362fcba4735a387f7cdd1024171.pdf?index=trueIn PDF document text
- https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_4b2283ac835e4278b5a1565cca87f154.pdf?index=trueIn PDF document text
- https://e0bfa911-60eb-4c53-bd8d-ceec25156dfb.filesusr.com/ugd/0a052f_8c948ba5f1f04eacaac7828d1e600033.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/390794f4-01a8-4d3c-bce0-fc72a955d760/robin_hood_disney_prince_john_plan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18cbd473-cc14-4b2a-b718-3aead3a796f8/titofiwajakivinutike.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fbbc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBBC | 5580 bytes |
SHA-256: fa848431e057763c859edf92646b05916c157467d7982d19d19f4230af58d9d7 |
|||
font_01_sfnt_off00010eba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EBA | 10828 bytes |
SHA-256: c3d8d8d10957ae9dbe9a15825c373095720573583115efc3872aa845c3486d6b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.