MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, with the PDF being identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and numerous external URLs suggest it's designed to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=traxxas+t+maxx+2.5+axles PDF link annotation
- https://banetopebored.weebly.com/uploads/1/3/4/8/134874573/sirabawotuguzir_gebisumojus.pdfIn PDF document text
- https://nedamekiwuj.weebly.com/uploads/1/3/1/3/131379605/7fc400bd.pdfIn PDF document text
- https://pawusavexamase.weebly.com/uploads/1/3/0/8/130813618/xexotoviru_govema_vadosaso_zujewiramubu.pdfIn PDF document text
- https://kewakovek.weebly.com/uploads/1/3/4/4/134467638/rerovadivo.pdfIn PDF document text
- https://dusivasawomila.weebly.com/uploads/1/3/4/6/134660852/6068872.pdfIn PDF document text
- http://pizeval.iblogger.org/19563767052.pdfIn PDF document text
- http://vijofogozorumi.22web.org/59584264940.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://jolivawojo.rf.gd/38158200880.pdfIn PDF document text
- https://48b7024d-7414-4593-b44d-ed892b96ad15.filesusr.com/ugd/3e5db3_48b2de689d594960bcb93cec4a201fe8.pdf?index=trueIn PDF document text
- https://5e04165b-6ab1-49a6-9937-45006fc2fbeb.filesusr.com/ugd/d19879_4c3903ec0ca048a7a9b6612bcedc7653.pdf?index=trueIn PDF document text
- http://wigifanike.epizy.com/48464434894.pdfIn PDF document text
- https://52a72965-a6d2-471e-b66a-59a59a4d663b.filesusr.com/ugd/e643da_75b320559546488bad42a95775667060.pdf?index=trueIn PDF document text
- http://gobovavori.rf.gd/ligutijoraligabitamo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/053fc77f-1f98-4008-a146-37e841a9604c/cen-tech_multimeter_user_manual.pdfIn PDF document text
- https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_ab86e6cfe3614b80a48aa010b9b82d45.pdf?index=trueIn PDF document text
- http://fategag.rf.gd/element_fire_tv_remote_not_working.pdfIn PDF document text
- http://fapibudu.epizy.com/buddha_charitra.pdfIn PDF document text
- https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_6453fba6af944feaa6a6b60d5d79a5c4.pdf?index=trueIn PDF document text
- http://vinodek.epizy.com/curacao_road_map.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a0a98ccd-fe53-4b63-8f80-96926d80eec6/39664223420.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89d1eca2-8747-43fb-bb84-76547f530947/mewavetezapafobulekujara.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cf4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCF4B | 5136 bytes |
SHA-256: 06c71fcff39329a51cb0d40f29746b8f88ffd8b3d44ac29318f13c022ae2c5fa |
|||
font_01_sfnt_off0000e0b7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE0B7 | 10680 bytes |
SHA-256: c85b1793dff26271b6ea510d2048c355848e0142f0094424b99256bcfc71d37c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.