MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of embedded URLs, many of which are on disposable hosting and utilize UTM parameters, indicating a link farm or spam distribution tactic. The presence of external URIs and the overall structure strongly suggest a phishing attempt or a campaign to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=2002+dt466e+injector+torque+specs PDF link annotation
- http://firejowetawo.iblogger.org/shortcut_keys_and_full_form_of_computer.pdfIn PDF document text
- http://bratskpravojur.ru/dwarf_fortress_mods_44.12rwlf3.pdfIn PDF document text
- http://infonewsuk.site/jufoxumigarale9e7xt.pdfIn PDF document text
- http://lnstagramlivesupportcenter.com/legions_of_rome_mod5s3mg.pdfIn PDF document text
- http://vafutixon.22web.org/xolemuwokegojiju.pdfIn PDF document text
- http://patagoxipu.iblogger.org/65934151956.pdfIn PDF document text
- http://dronextactical.xyz/88605093715ktcaz.pdfIn PDF document text
- http://kolomata.ru/sazevokajumegawutugono9ezh5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/9d5ebf77-eb82-4ba4-afc6-c9de05cc99df/97242674303.pdfIn PDF document text
- https://s3.amazonaws.com/dazuxujepov/9716855812.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71a44c38-5958-4af6-aa02-b0b4ad98e6e9/harry_potter_books_1-7_boxed_set.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/70fe00d4-5c50-4f2d-9be2-6342161b5d6b/java_8_update_271_64_bit_filehippo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85d51f69-a5ea-49ea-a904-ded6a10af4eb/how_to_turn_the_fuel_up_on_a_roosa_master_pump.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b7fa0bc-d9a9-41b5-88bf-a1583ae03246/mens_health_training_plans.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a844620a-4058-41c4-a22f-18185b84b3ca/el_formato_apa_lleva_numero_de_pagina.pdfIn PDF document text
- https://s3.amazonaws.com/kofabube/are_volcanic_gases_dangerous.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4c33ead3-87cf-4b3d-838d-c3b09c69d94b/bodazomexiluwabi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c51f2d41-6fcb-4a3e-a10b-99add8d2fd0d/oracle_sql_advanced_select_statement_examples.pdfIn PDF document text
- https://s3.amazonaws.com/jolituzoji/exerpeutic_folding_bike_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1c1bf6c9-8556-4a71-8a8e-07dec87b8493/68608041428.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9cca5f13-026c-41d1-8002-5ced618d661f/13595198970.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de0794b1-7e9d-4052-86d8-43a9feb920dc/mefux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81b60c06-5d98-4cd4-b760-12ef8f7a67d5/lupesopoku.pdfIn PDF document text
- https://s3.amazonaws.com/gisujubolidine/hp_3647h_motherboard_manual.pdfIn PDF document text
- https://s3.amazonaws.com/pisik/51487685221.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f51b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF51B | 5448 bytes |
SHA-256: b1caf948a0aec833ab11dee1ed61cb0258589de4fb2c0598c309b50ab9770e14 |
|||
font_01_sfnt_off000107c3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107C3 | 10452 bytes |
SHA-256: fcd7efd9c5514f630c5400feebd04dd0e5a013691aa4b87d051c17cc40c53683 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.