MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one pointing to 'xajibur.ru', suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing lure, likely using a popular media reference to entice clicks.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=harry+potter+1+movie+free PDF link annotation
- https://norusukesalija.weebly.com/uploads/1/3/4/3/134356509/9052071.pdfIn PDF document text
- https://vokipokulolobu.weebly.com/uploads/1/3/4/0/134016984/najulinuz.pdfIn PDF document text
- https://wikexedijul.weebly.com/uploads/1/3/4/6/134659224/4373546.pdfIn PDF document text
- https://sozatoma.weebly.com/uploads/1/3/4/4/134484551/kazofomujatudi-julirakitasav.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/polojuliragam/35328920089.pdfIn PDF document text
- https://s3.amazonaws.com/gizonukorad/josejeraworesatogak.pdfIn PDF document text
- https://s3.amazonaws.com/mefovu/how_to_program_comcast_remote_to_magnavox_tv.pdfIn PDF document text
- https://6997f972-013f-4c6f-ac95-4179ba17a557.filesusr.com/ugd/549e1a_78e4cfedce2e401db7f493079db2b5ca.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/titugome/aptoide_for_pc_windows_10_free.pdfIn PDF document text
- https://s3.amazonaws.com/febopa/dsssb_warder_exam_answer_key.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd65c2b0-d246-4fe0-820b-b0f9d8100320/ashton_drake_baby_dolls_katie.pdfIn PDF document text
- https://s3.amazonaws.com/tuxenipup/wobilepotanuvonuzanajas.pdfIn PDF document text
- https://s3.amazonaws.com/febopa/latex_bibtex_cite_report.pdfIn PDF document text
- https://s3.amazonaws.com/xipavir/allu_arjun_latest_movie_ringtones.pdfIn PDF document text
- https://s3.amazonaws.com/rabewiruzitewa/95346929780.pdfIn PDF document text
- https://21319658-e817-4d6a-846f-872ccfe0f0c2.filesusr.com/ugd/982af2_955d68c209e5435f81cfcd0c5c00184c.pdf?index=trueIn PDF document text
- https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_7289594b3afb4ca496cfaf29e9d46627.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jofunozuzof/56954991373.pdfIn PDF document text
- https://s3.amazonaws.com/defujo/index_match_return_multiple_values_google_sheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6840fa98-3115-4cc6-a8b0-4a53e61eb72f/how_do_you_make_a_baby_toga.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4ce2ce1-f5df-4e44-b4be-16272127d97c/par_quoi_remplacer_la_fve_dans_la_galette_des_rois.pdfIn PDF document text
- https://s3.amazonaws.com/zumezeviwakiz/how_to_tell_when_my_mossberg_500_was_made.pdfIn PDF document text
- https://f72e0e13-a873-49c5-9cb5-3c2848b8c5b2.filesusr.com/ugd/f8ba4b_507439f14019437780beae766c355a5f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9efa0faf-c6f7-422d-970e-b5c1ac32441f/18225905387.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fdd1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDD1 | 5012 bytes |
SHA-256: 236c62cb898942119a2ff10b71b3539b990529f64e060e18d933e43835b9fb50 |
|||
font_01_sfnt_off00010ee2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EE2 | 11160 bytes |
SHA-256: 79139434e51c59a147641e3adbc55de18a11cb52ceaa3d804e4e17b5e3722b35 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.