MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external URIs, with a high-confidence ML classifier and ClamAV detection indicating malicious intent. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests a link farm designed for SEO manipulation, pointing to a disposable hosting service. The primary malicious URL identified is https://jottigo.ru/123, which is likely used to deliver a secondary payload or conduct phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=leave+a+light+on+piano+sheet+easy PDF link annotation
- https://cdn-cms.f-static.net/uploads/4478415/normal_60124edc56a72.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453889/normal_5fd8f62853669.pdfIn PDF document text
- http://nokasosozigof.mypressonline.com/69233769859.pdfIn PDF document text
- http://rakapugijumub.sportsontheweb.net/tratamiento_fisioterapeutico_para_hernia_discal_lumbar.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369179/normal_60494212c3547.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407562/normal_5fdf57d5ca885.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489041/normal_604f923ab4f92.pdfIn PDF document text
- http://taxokisekajetek.22web.org/dilawejopelanipikuf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403422/normal_60493354d46aa.pdfIn PDF document text
- http://fipizilemuwob.medianewsonline.com/how_to_treat_gum_pockets_naturally.pdfIn PDF document text
- http://faxozulakevosos.iblogger.org/account_balance_transfer_letter_format.pdfIn PDF document text
- http://golixudib.mypressonline.com/percy_jackson_series_disney_plus_actors.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388276/normal_5ff5cc508def4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/sojebelevenex/responsive_design_html_css_template.pdfIn PDF document text
- https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_90bfcae89b0148c8b6ab8490321825f7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bufexa/coursera_probabilistic_graphical_models_quiz_answers.pdfIn PDF document text
- http://bodirinukamole.onlinewebshop.net/amplitude_modulation_numericals.pdfIn PDF document text
- https://d80868e2-5d34-4dda-9345-0396294a35aa.filesusr.com/ugd/f9fac6_4329a2e8c30a4720a6e02aba3f4852f0.pdf?index=trueIn PDF document text
- https://02ee9779-94d6-4ec7-959f-c0f99fe19a35.filesusr.com/ugd/cdc607_6ab4000f87864a27b5b44376d694ec60.pdf?index=trueIn PDF document text
- https://81d89a68-18ac-4cf1-ad00-ddd5d2f7da41.filesusr.com/ugd/ed58ef_15218b310014468dbba226ad24fdb6d2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nelizenejakarug/colors_kannada_voot_app.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb7e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB7E | 4876 bytes |
SHA-256: ff7183466b623aba5a5f130d25eb3b464ec01a3b79bbf5f8c0a7e7d66e2e8a18 |
|||
font_01_sfnt_off0000fc18.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC18 | 11624 bytes |
SHA-256: df066bb3d65f98843511b4a9eb0dee669133af9fdeb61b4c9f93182eb3b0657a |
|||
font_02_sfnt_off000123e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x123E1 | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.