MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm. One prominent URL, 'https://botokaw.ru/strik?utm_term=why+does+my+dog+run+when+she+sleeps', is likely used to direct users to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9967
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=why+does+my+dog+run+when+she+sleeps PDF link annotation
- https://gixajime.weebly.com/uploads/1/3/4/7/134745735/vixibisorude-woxazipogi-fawodojezifigo-dojolonadudepan.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445743/normal_60632f8fab910.pdfIn PDF document text
- https://vimawagugagepa.weebly.com/uploads/1/3/4/7/134732412/bawegezikigutek.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4527357/normal_601cbef2e03c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492257/normal_605efe8b50212.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462974/normal_60443ee154e7d.pdfIn PDF document text
- https://lemosipezo.weebly.com/uploads/1/3/5/3/135326275/gisoboz.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4374857/normal_5ff402a0c101c.pdfIn PDF document text
- https://lijemokuw.weebly.com/uploads/1/3/4/8/134853622/5faf1007f693ac.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489028/normal_5ff02e29b4656.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426263/normal_5fc652a335112.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4386089/normal_5fcf2f3f253c5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3c624093-c77e-430e-9a78-14bf29fe786e/sizenulatewufu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/debafb9e-a8bf-40d2-b923-9a195b189689/nabomomozuw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/940dee2e-dd01-4706-8984-5d8b117a9ff6/39860708992.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75ece772-b126-4cba-8c6d-80c078b2c077/77725067652.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f35ad6a-3f68-4b40-9d57-8fa3f84fc666/moog_sub_37_vst.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bdc265d9-8b0f-4f81-963d-206c160580dc/how_to_reset_clean_light_on_mr_coffee_maker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7aab05e-7c13-4023-b84f-653732dc6ca0/donkey_kong_64_level_3.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31b1ce77-f9cc-48de-8bb8-84e9b0066fd4/slinglink_turbo_w1_model_sl300-100_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6f1b1b3-c041-4191-b431-b0c8ba6dfd78/rizazitijuxetoluro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f87ae4e3-bf40-4e33-8b24-527a35a73db4/why_wont_the_brush_on_my_dyson_spin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51f174d2-f329-4a8f-bea8-002aa45d9ca6/42896845534.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ddd7152f-cc99-4694-9c96-4dac4b1d4109/sukenefadutenunejab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73d8d29b-16d6-4fee-b6af-8c1612e73ee4/does_ch2cl2_have_a_net_dipole_moment.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/24895037-128c-421f-aaac-855942ec7c43/how_to_reset_acer_aspire_battery.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f51a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF51A | 5372 bytes |
SHA-256: 7184397fbd770a01ba48c9ca5d927204965e9ab6bfb2d68095a34f1935203109 |
|||
font_01_sfnt_off00010752.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10752 | 11140 bytes |
SHA-256: bf262a7e479aba3016ff29f63cfe8dd898919a9a90e38b0e99b7d80240a3d99f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.