MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO poisoning tactic. The primary URL, https://jacksth.ru/award?keyword=arthur+spiderwick+s+field+guide+pdf, indicates a lure related to a specific PDF title. While no scripts were explicitly extracted, the PDF structure and heuristic firings like PDF_SEO_LINK_FARM and PDF_URI strongly suggest malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/award?keyword=arthur+spiderwick+s+field+guide+pdf PDF link annotation
- https://dubelaxelafef.weebly.com/uploads/1/3/1/1/131164372/9664298.pdfIn PDF document text
- https://bezofaxifi.weebly.com/uploads/1/3/1/6/131606652/ef4e8.pdfIn PDF document text
- https://wivixape.weebly.com/uploads/1/3/4/8/134897282/bewilolem.pdfIn PDF document text
- https://nudabixe.weebly.com/uploads/1/3/4/5/134505388/webavu-xexusufox-xejobaju.pdfIn PDF document text
- https://dewokazivefin.weebly.com/uploads/1/3/1/4/131437233/deratelovajixudixu.pdfIn PDF document text
- https://dobuxodujunov.weebly.com/uploads/1/3/2/7/132741154/xuzidirujesat.pdfIn PDF document text
- https://fotofewoxa.weebly.com/uploads/1/3/4/8/134849098/sadidusig-bomijebevileto-wapupo-zewabi.pdfIn PDF document text
- https://zorivaleguzovul.weebly.com/uploads/1/3/4/5/134596353/2c878751fd576f6.pdfIn PDF document text
- https://xazonidunigi.weebly.com/uploads/1/3/4/5/134590253/4239621.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/vefagotoje/38066663104.pdfIn PDF document text
- https://s3.amazonaws.com/loranoduzuja/juzokaruxekavikokibozelup.pdfIn PDF document text
- https://s3.amazonaws.com/ziwuvijevo/harry_potter_flute_sheet_music.pdfIn PDF document text
- https://s3.amazonaws.com/wovisak/smoke_effect_brushes_for_photoshop_free.pdfIn PDF document text
- https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_12950f7be19248fd82c3cfa398bd6bd7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bf0ab40e-b45b-470d-ac22-462da49faeb5/dewalt_dw745-xe_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32a63d55-4de2-40b6-a9a8-f70ab4bef151/86316877209.pdfIn PDF document text
- https://56c41596-c8b3-4aa7-a075-23c9724d7f97.filesusr.com/ugd/ed77b2_c90f66eb639849598939c440ee0dac3e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zikeko/house_construction_schedule_template_excel.pdfIn PDF document text
- https://s3.amazonaws.com/sirilagewuga/16135456692.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/95c9fde9-61af-4451-86f1-ce2dcd29af76/baby_girl_names_and_meanings.pdfIn PDF document text
- https://s3.amazonaws.com/befarekogol/72537480731.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/40b9da8c-100e-47cb-97fa-2ad618340ecb/dutumilitijuron.pdfIn PDF document text
- https://s3.amazonaws.com/webipejonavuv/3216238698.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ced0e28-6f19-446a-8415-9eaceab9b436/how_does_emdr_change_the_brain.pdfIn PDF document text
- https://s3.amazonaws.com/fakuguvil/xajesiminunapifoj.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e888.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE888 | 5352 bytes |
SHA-256: 5f2c13ff6f56fa3020cc4c9961870bb9cefc9d38f7c708339fb78b7a17edaf21 |
|||
font_01_sfnt_off0000fad1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAD1 | 11072 bytes |
SHA-256: 9165b2d1505a414dcb644348b58b22ed6d0865e3b2df3753aecad8e8af849ca2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.