MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, including one pointing to 'jottigo.ru', which is flagged as suspicious. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or phishing attempt. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely related to phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9946
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/strik?utm_term=casio+g+shock+triple+sensor+multiband+6+tough+solar PDF link annotation
- http://dorulezebum.sportsontheweb.net/map_of_australia_outline.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407314/normal_601db530d3d5c.pdfIn PDF document text
- https://cdn.sqhk.co/kajipazuto/ie6gcdP/59015795183.pdfIn PDF document text
- https://cdn.sqhk.co/nifodotiriru/fhdWggZ/amtrak_scenic_routes_west_coast.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392444/normal_603775bf56c0a.pdfIn PDF document text
- http://xafopawiki.medianewsonline.com/branches_of_medicine_and_their_meaning.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446017/normal_601061cf7547e.pdfIn PDF document text
- http://pibakulisup.medianewsonline.com/76392843931.pdfIn PDF document text
- http://xapowuxif.mywebcommunity.org/becky_albertalli_books.pdfIn PDF document text
- http://midimox.getenjoyment.net/voxolesavowekuwosan.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4457330/normal_5ffe10f6991cd.pdfIn PDF document text
- https://cdn.sqhk.co/wufakinupo/cghgfC7/download_super_party_sports_football.pdfIn PDF document text
- https://cdn.sqhk.co/kibutonap/jcsgeMI/kaiser_permanente_seattle_member_login.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gidibesuxi/certificate_templates_word_doc.pdfIn PDF document text
- https://s3.amazonaws.com/moduxanakuri/wordscapes_in_bloom_cheats_and_answers.pdfIn PDF document text
- https://s3.amazonaws.com/bisute/musescore_jazz_lead_sheet_template.pdfIn PDF document text
- https://s3.amazonaws.com/ligole/xokivurinijufitaxox.pdfIn PDF document text
- https://s3.amazonaws.com/geraromu/burrows_wheeler_transformation_example.pdfIn PDF document text
- https://bc13a564-db4d-4abe-bba9-081b1c4085ef.filesusr.com/ugd/d5ec75_368dc7de5571457e865bfd6fa90d746d.pdf?index=trueIn PDF document text
- https://7fd4abad-31f8-4c52-ae8e-93d0cc7f2af2.filesusr.com/ugd/910e70_db90c32767e24f5bb88e2a2d593ce1ce.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pusori/fujaponiwebupaka.pdfIn PDF document text
- https://s3.amazonaws.com/pugomonapoxuxe/wepavebedazeved.pdfIn PDF document text
- https://s3.amazonaws.com/wusigipufuvowix/3_types_of_intermolecular_forces_worksheet.pdfIn PDF document text
- https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_6c06848cc34e4acaa32d1233ccdaaaa2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tokatefozude/new_whatsapp_status_video.pdfIn PDF document text
- https://535a9070-e28a-464b-adc5-c02ad08be00b.filesusr.com/ugd/9df9d6_c3a74e0956bf40ae8ccd7b5c14215e0d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tumuzu/85976705085.pdfIn PDF document text
- https://04a80c79-134c-446e-801b-0c1635678e59.filesusr.com/ugd/5cebf8_cd8e106458724289a229c864dabcfd27.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000133df.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x133DF | 5752 bytes |
SHA-256: 147a4a9ea0dc537d0d92b35595f37ead596195c7370173f77adf7b144c0c11de |
|||
font_01_sfnt_off0001472e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1472E | 1760 bytes |
SHA-256: 0863afeb00bd8a44037eba8d3bd385e73bce0008306cd01217e4f6a39e7015d1 |
|||
font_02_sfnt_off00014fc8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14FC8 | 10784 bytes |
SHA-256: 5238b1e58ec4abc52c7651a340d2409a2cf379d6525e5ff438e99c7e96af5b8d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.