MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document functions as a link farm, directing users to numerous external websites, including a suspicious URL at 'xezojetit.ru'. The presence of a large number of external links and the ML classifier's high confidence score indicate a malicious intent, likely for phishing or distributing further malware. No scripts were extracted, but the PDF structure itself is used to facilitate the redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=how+many+drops+of+lavender+in+diffuser+for+sleep PDF link annotation
- https://cdn-cms.f-static.net/uploads/4448550/normal_605d73ee23c46.pdfIn PDF document text
- http://lurobur.iblogger.org/how_to_reset_master_code_on_kwikset_lock.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454162/normal_6050d8c261271.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_566202b6538b46879c1bfd950494ec1a.pdf?index=trueIn PDF document text
- http://tadoloko.epizy.com/disc_personality_types.pdfIn PDF document text
- https://a161ff94-1a6f-4367-b6f8-8e513a5e676d.filesusr.com/ugd/4c7633_c3089ce8a8cc4578ac965d407ec5e87b.pdf?index=trueIn PDF document text
- http://popeganezawojeg.rf.gd/tavuzerodopowitopa.pdfIn PDF document text
- https://e50eee24-2d95-422d-8083-6f618d95927b.filesusr.com/ugd/594ae5_2bdbbfe9a4884304ba66e45313134d44.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/matogapibelifiv/bamoborufirunasunub.pdfIn PDF document text
- https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_dce3f7c062de4de5ac828f86ab553f99.pdf?index=trueIn PDF document text
- https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_820bee16da3640598f69743382952c71.pdf?index=trueIn PDF document text
- https://32b33340-d9da-4ef7-b3bd-a0ac5134eb71.filesusr.com/ugd/adfa6f_ae508be035934b23ae462c909f4baf58.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/suxuzubojut/how_to_reset_pioneer_radio_divx.pdfIn PDF document text
- https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_3af17f6ef26244a681175367a2d5778a.pdf?index=trueIn PDF document text
- https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_22034b0759ca46d286342bab88754a8d.pdf?index=trueIn PDF document text
- http://gisobugiwe.rf.gd/frame_relay_and_atm.pdfIn PDF document text
- https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_df55bb7dceb84728abb7d0973454e6c5.pdf?index=trueIn PDF document text
- http://xodenumaverap.epizy.com/79617216175.pdfIn PDF document text
- https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_7877550426cb44a9a3ceccc158f971f0.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012cec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CEC | 5400 bytes |
SHA-256: 3378dc7a62b4de90ed8f986404d359393ca9cca4c1dfdb243f0bc6d26d2afe67 |
|||
font_01_sfnt_off00013f4f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13F4F | 11404 bytes |
SHA-256: 42d1f12eaab4df9bdf7216abb2985d47ca4ae6192d02a2e55898cb4812e9b33e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.