MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many pointing to disposable hosting, and is detected as a phishing/trojan by ClamAV and an ML classifier. The document body, though heavily obfuscated, suggests a lure related to a maintenance manual. The presence of numerous external links indicates a likely attempt to redirect users to malicious websites for further exploitation or credential harvesting.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=cessna+172s+maintenance+manual PDF link annotation
- https://cdn-cms.f-static.net/uploads/4367017/normal_6024750c5b772.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4370092/normal_5fc596ff90156.pdfIn PDF document text
- http://re-prime.ru/washington_state_unemployment_rate_june_2020xaay4.pdfIn PDF document text
- https://zamosokajuzosa.weebly.com/uploads/1/3/4/6/134651904/5690738.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408009/normal_604bb87de16a5.pdfIn PDF document text
- http://feyakast.online/6855781580q4ba8.pdfIn PDF document text
- https://xosebabonewita.weebly.com/uploads/1/3/4/6/134613761/bomibudobavoxo.pdfIn PDF document text
- https://rajuputodetu.weebly.com/uploads/1/3/4/6/134682309/mugedo_bojaluwibuz.pdfIn PDF document text
- http://lnstagram-blue-ticks.com/xibofujumeditkygce.pdfIn PDF document text
- http://wrinklestiltskin.com/how_to_set_time_on_oster_coffee_makerb0ko1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_eed9159f561e4a44b8d52c7608b28e59.pdf?index=trueIn PDF document text
- https://367e539a-c541-4439-991c-4bf2bef2aa7a.filesusr.com/ugd/77d535_3b6a687af5ac4036beca609cb2b5f2ff.pdf?index=trueIn PDF document text
- https://9d76d0c6-5807-43ac-a2ba-7b4112d1a20a.filesusr.com/ugd/5cd33b_c267d20872ee4b31a663d3a1d0937c82.pdf?index=trueIn PDF document text
- https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_802f5987f01e4e5fbb90e9176595b468.pdf?index=trueIn PDF document text
- https://0dd4521b-3e41-4083-9bcc-807cce03ae78.filesusr.com/ugd/cfe2e9_df532575d831401bb058332b1e38fb0b.pdf?index=trueIn PDF document text
- https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_59490d82fbce4e1eb6fa97f242becb42.pdf?index=trueIn PDF document text
- https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_3c80d09f5d1c41adab14ca012e65288f.pdf?index=trueIn PDF document text
- https://34570882-574e-4d25-8c0e-d8b9b6c2967f.filesusr.com/ugd/cb2bed_f0ca645ab5a448069a49943cb2f876e2.pdf?index=trueIn PDF document text
- https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_c0d3dd419eee4e1291fe6e7e64cdc2f2.pdf?index=trueIn PDF document text
- https://f79c4d19-9b07-4ca9-ba82-4f938217db57.filesusr.com/ugd/c0d3e8_6639c239f5d8419f873194928353ec0e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cb6c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCB6C | 5016 bytes |
SHA-256: 727241db1007e8dc038d1360f948860d8ebf9359e246d0bcbcf397ea0986f0d9 |
|||
font_01_sfnt_off0000dc77.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDC77 | 9664 bytes |
SHA-256: 18190b7ac80519809432fa28849d2e710447d86cc48e6717b5cae3ec8c311fa5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.