MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It functions as a link farm, containing numerous external URLs, with at least one, 'https://jottigo.ru/123?utm_term=car+parking+games', being of unknown reputation and potentially malicious. The PDF structure and embedded content suggest an attempt to lure users to malicious sites, aligning with spearphishing tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=car+parking+games PDF link annotation
- http://cashtanks.fun/sig_p229_9mm_classic_carry_reviewzmgcx.pdfIn PDF document text
- http://evilcheats.fun/blue_team_handbook_incident_response_edition_free_downloaduezep.pdfIn PDF document text
- https://domexuvuk.weebly.com/uploads/1/3/0/7/130740212/musupani.pdfIn PDF document text
- http://segway-wheelchair.ru/25973826873teh13.pdfIn PDF document text
- http://reznitskygallery.com/munurofikamp3k8.pdfIn PDF document text
- http://evromotors.net/fifty_shades_freed_movie_download_in_hindi_480p_filmyzilla5rjbh.pdfIn PDF document text
- https://tonudekosinin.weebly.com/uploads/1/3/4/6/134685286/2284095.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_0fa00a89880142cb8fc92d2c120f73e1.pdf?index=trueIn PDF document text
- https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_ab69150095b74525bf29a230962eed1f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fbdf390d-37bc-493e-add3-0413f9b4348f/the_count_of_monte_cristo_2002_film_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31db0356-5f88-43ba-b813-181927a84674/harry_potter_12_days_of_socks_mens.pdfIn PDF document text
- https://d90bda3b-35dd-409f-9d4b-b4a00d881a52.filesusr.com/ugd/b88e3d_e3f760ba0f00473fb20e525b1b53d11d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/eddb0f2c-54ed-461c-bf34-60a6be7cfd4b/homelite_chainsaw_tune_up_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e22481b-b6bc-4d11-a1ef-d46840202f79/what_is_the_meaning_of_apple_tree_in_my_dream.pdfIn PDF document text
- https://9c12218e-e157-4070-b33f-4467b3cb42bb.filesusr.com/ugd/0c60a0_cabcb072b99447478c7a9869fb1c8e0f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2863c6ee-1ea7-42cf-99dc-b965cb9e0df2/ms_project_studentenversion_download.pdfIn PDF document text
- https://02274cc9-8b57-4441-be19-e46c089ec46b.filesusr.com/ugd/f11b8f_6ee0900e33b24134bc080ef8259b0330.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/21340e94-1ad6-4a36-a66a-683df62131cd/dell_u2415_weight_with_stand.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6d53018-e860-4f7a-8c8d-bed758aee284/soguw.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dff5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFF5 | 5076 bytes |
SHA-256: 0704a14d8e06513847710813e0f1953c3bb776959e63ab97caace0927ec50f8b |
|||
font_01_sfnt_off0000f128.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF128 | 10188 bytes |
SHA-256: 202bb2f7a0af919f01bdcb528922ab6950de647b0fc3909dc66be3409b9ea07d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.