MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ClamAV and an ML classifier, and it contains a large number of external links, many of which are to PDFs. The primary URL, 'https://jumiwimov.ru/strik?utm_term=bosch+silence+plus+44+dba+use+and+care+manual', suggests a lure related to a product manual, likely to trick users into clicking through to a malicious site or downloading further malware. While no scripts were explicitly extracted, the PDF structure and the high number of external links are indicative of a phishing or SEO poisoning attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=bosch+silence+plus+44+dba+use+and+care+manual
- https://cdn-cms.f-static.net/uploads/4416806/normal_6018b85c379b9.pdf
- https://static.s123-cdn-static.com/uploads/4505699/normal_5ffd876ff246e.pdf
- https://cdn-cms.f-static.net/uploads/4461245/normal_5fd15899f3186.pdf
- https://cdn-cms.f-static.net/uploads/4408188/normal_5fe8f57cd3086.pdf
- https://cdn-cms.f-static.net/uploads/4391621/normal_601841cb06e1a.pdf
- https://cdn.sqhk.co/wopeporamo/7hIgifq/misijutilun.pdf
- https://cdn-cms.f-static.net/uploads/4481528/normal_5fd315dcb4898.pdf
- https://cdn.sqhk.co/riroxale/gifjiqY/datokagatajaxubusatotupif.pdf
- https://cdn-cms.f-static.net/uploads/4455883/normal_5fdad0e290bd8.pdf
- https://cdn.sqhk.co/vixemujomu/c3jaggp/15442307272.pdf
- https://static.s123-cdn-static.com/uploads/4369920/normal_5fce5bb9ee4a5.pdf
- https://cdn.sqhk.co/nomuzali/ji05haN/40479391642.pdf
- https://static.s123-cdn-static.com/uploads/4418783/normal_5fccf7820c5f2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/zategafozasiru/graphing_absolute_value_equations_worksheet_answers.pdf
- https://s3.amazonaws.com/toniseligiwuzux/biwusiwuvatofisafitob.pdf
- https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_d572210e43ce42c382913e9193cbb1c7.pdf?index=true
- https://s3.amazonaws.com/zumezeviwakiz/fawoboli.pdf
- https://s3.amazonaws.com/pegebunov/naloxebu.pdf
- https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_684ab4d36905439dbbde9abe695ac2d4.pdf?index=true
- https://s3.amazonaws.com/metakibeme/kaxepetufafewululasalobo.pdf
- https://s3.amazonaws.com/gotitibekovi/medscape_physician_compensation_report_2010.pdf
- https://ed59cdd8-0d75-4634-8bb2-7afdb9da103e.filesusr.com/ugd/9cb112_61ffbe7bf0df4aac8359debc9fbe5ecb.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e992.bindb1f5fe5da8e1db3501d6facc631b2deb15ebaf1849fe5c734123686229c3a2d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE992 | 5588 bytes |
font_01_sfnt_off0000fc69.bin6291838a34c620f27d6841e12ac51900831434d433318c89fdcc138f7571cc71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC69 | 10408 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.