MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link farm and an embedded URI, suggesting a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were directly extracted, the PDF structure and embedded links point towards a malicious document designed to lead users to external, potentially harmful, content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9891
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=how+to+fill+passport+application+for+minors PDF link annotation
- https://guxolufesa.weebly.com/uploads/1/3/4/4/134468064/ziputegev.pdfIn PDF document text
- https://pikupazu.weebly.com/uploads/1/3/4/5/134577858/2d62c129c.pdfIn PDF document text
- https://revijokatise.weebly.com/uploads/1/3/3/9/133999222/wuzoba.pdfIn PDF document text
- https://balabirow.weebly.com/uploads/1/3/4/6/134690292/fafekiwuvusewumova.pdfIn PDF document text
- https://jogabaxeke.weebly.com/uploads/1/3/4/7/134704809/witoxu_bujuvixoxib.pdfIn PDF document text
- http://nokewobepasag.22web.org/nivegifibu.pdfIn PDF document text
- https://pesasujax.weebly.com/uploads/1/3/4/8/134882000/1c0c77d21e9.pdfIn PDF document text
- http://wutulesarox.iblogger.org/zekojuv.pdfIn PDF document text
- https://robugagemo.weebly.com/uploads/1/3/5/3/135304688/gikepumawemo.pdfIn PDF document text
- https://roparinupiw.weebly.com/uploads/1/3/5/3/135392621/xodade_vuxibogegov_nasejisejikozi_lojunurew.pdfIn PDF document text
- https://fosijegaden.weebly.com/uploads/1/3/4/8/134868146/ripuxesebeginol.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/radubozufiwo/92339090223.pdfIn PDF document text
- https://s3.amazonaws.com/limewub/inside_al-_qaeda_and_the_taliban.pdfIn PDF document text
- https://s3.amazonaws.com/panokojol/84644196638.pdfIn PDF document text
- https://s3.amazonaws.com/tawosutosuxi/business_english_for_beginners_a1_a2.pdfIn PDF document text
- https://s3.amazonaws.com/zumezeviwakiz/craftsman_chainsaw_16_36cc_parts.pdfIn PDF document text
- https://s3.amazonaws.com/tokafanawa/zuboxusebeped.pdfIn PDF document text
- https://s3.amazonaws.com/jupoti/spotify_music_quality.pdfIn PDF document text
- http://ponowuvibux.epizy.com/college_algebra_questions_and_solutions.pdfIn PDF document text
- http://romamosok.rf.gd/bangladesh_railway_application_form_2019.pdfIn PDF document text
- https://s3.amazonaws.com/xowasosuf/fuzarinozagelikoxunerukul.pdfIn PDF document text
- https://s3.amazonaws.com/wejuvono/casio_wk_6600_midi.pdfIn PDF document text
- https://s3.amazonaws.com/xojafemori/matrices_problems_and_answers.pdfIn PDF document text
- http://pimovutune.rf.gd/vemajidakawuza.pdfIn PDF document text
- https://s3.amazonaws.com/polexebuj/xurawarereruwiveb.pdfIn PDF document text
- https://s3.amazonaws.com/jamuluvuvava/bugaboo_carrycot_sheets.pdfIn PDF document text
- https://s3.amazonaws.com/bidurudilidujug/wukozarojofedije.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015eeb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15EEB | 4884 bytes |
SHA-256: 24a6b91ce5076eb09356bac68e3f458a6091582b020a5bff2ffda39e861b8c62 |
|||
font_01_sfnt_off00016f5b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16F5B | 2344 bytes |
SHA-256: 4bfb34d8583355c88f48015d97f2d1250508a1c49bb2b847d33e1ce51eddbd75 |
|||
font_02_sfnt_off00017961.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17961 | 11508 bytes |
SHA-256: 7f5b21a983c62e1fcb61ae0887b4dc9b7c8a9a3d54394f3139fcddd90d486864 |
|||
font_03_sfnt_off0001a089.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A089 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.