MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan variant. It contains numerous embedded URLs, including one that appears to be a link farm on disposable hosting, suggesting an attempt to redirect users to malicious sites. The document body, though heavily obfuscated, contains text related to a car seat manual, likely a lure to disguise the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/wix?keyword=graco+click+connect+35+lx+car+seat+manual PDF link annotation
- http://xafesuvorolivig.scienceontheweb.net/89903349328.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425910/normal_600b6aa6c963d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403560/normal_5ffdf0a965ed7.pdfIn PDF document text
- http://ligugiban.scienceontheweb.net/rixosi.pdfIn PDF document text
- http://mirumumavetifun.mypressonline.com/sonata_pathetique_piano_sheet_music.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385206/normal_603aecd541dfb.pdfIn PDF document text
- http://ziwewixowele.sportsontheweb.net/teacher_centered_approach_definition.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488581/normal_600bad1cd1480.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0f65d951-0aeb-47f5-94ec-3147821af899/do_parallel_lines_meet_at_infinity.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51e472a6-6869-4d7b-9928-f6a1e7cb3839/42536034690.pdfIn PDF document text
- https://s3.amazonaws.com/tarajix/rajezodofunijuvarovoput.pdfIn PDF document text
- https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_ba686e37ee2f4df8a6cb5ff74086cc42.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ximupuv/42991158741.pdfIn PDF document text
- https://s3.amazonaws.com/wenobagupexekap/dewadomuvotuj.pdfIn PDF document text
- https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_8953794fd55048419fa3fbad89f5ab01.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5017a249-addf-4334-9226-00f215489bb3/what_is_the_difference_between_weber_genesis_ii_and_spirit_ii.pdfIn PDF document text
- https://s3.amazonaws.com/xebuvuwov/indira_gandhi_history_video_tamil.pdfIn PDF document text
- https://58eafb2e-ea74-4523-a1b2-d2e0fe9bfe54.filesusr.com/ugd/466fa0_68d3b46092c64cbbbdadfbb04c16d30a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lazolu/compliance_analyst_interview_questions_and_answers.pdfIn PDF document text
- https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_c52ee0a49ea44fb8a814e35772e725c2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5959a1b3-ff34-4744-bc52-9ab8547a613e/harry_potter_book_1_chapter_8.pdfIn PDF document text
- https://4694dce0-4d1e-4c77-b4da-d1f025f82355.filesusr.com/ugd/fb332b_be5d052a9a56480f9645264c5727c4fa.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/abf32bf0-d8a4-4e16-a854-859b6f558733/libro_de_espaol_segundo_grado_lecturas.pdfIn PDF document text
- https://459fb65c-52af-4c88-885a-43a44fbeaf25.filesusr.com/ugd/6a7407_c60d5eafd8c549c7b822c7a945aa84a7.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000105e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105E1 | 5396 bytes |
SHA-256: 2d28032aaafb14837f3d616c7e7072c9caa612922ed14c78c5fda0f3a89b6427 |
|||
font_01_sfnt_off00011831.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11831 | 10624 bytes |
SHA-256: f2e2384159e29b1369409adce93c13b946e38fe7499266a06cbadf3952118199 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.