MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external URIs, with a high-confidence heuristic identifying it as a link farm on disposable hosting. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URLs, such as 'https://xezojetit.ru/strik?utm_term=table+setting+for+christmas+ideas', are likely used to redirect users to malicious sites or download further payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=table+setting+for+christmas+ideas PDF link annotation
- https://cdn.sqhk.co/soribivevi/inslig6/balozaxo.pdfIn PDF document text
- http://7lessons.fun/house_cleaning_roster_template6pzq5.pdfIn PDF document text
- https://cdn.sqhk.co/janonaset/lgcghqd/the_lost_and_chosen_book_2.pdfIn PDF document text
- http://datingsexchat.site/79526222211xlkgg.pdfIn PDF document text
- https://cdn.sqhk.co/vibebexez/csFTrN3/pistol_shrimp_vs_mantis_shrimp_fight.pdfIn PDF document text
- https://cdn.sqhk.co/xaselavub/fjdoi8R/euro_truck_simulator_2_bmw_car_mod_download.pdfIn PDF document text
- https://cdn.sqhk.co/fikalibumi/p2haMLi/tezowobaxuka.pdfIn PDF document text
- http://befigter.xyz/why_is_grounded_theory_used_in_qualitative_researchft1yw.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6bbd7420-f04d-49b0-875c-8cbe5c41658e/what_are_the_seven_habits_of_a_highly_effective_teenager.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/702dd94c-2ee6-4c5f-a73e-0aef362b7fc8/gitoliwuxoxexolizaridap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a8f2e774-7fea-47e3-934d-ab5d89d28b39/how_to_paint_a_tree_trunk_with_acrylics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f25b9363-5cfb-4f8a-a0c1-aa3571bd8af2/rules_for_knights.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3b01af5-60bd-45b5-8607-509ee6ecab75/center_point_scope_4x16x50.pdfIn PDF document text
- http://dimogotewebi.epizy.com/48427686865.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/245b7eb3-3b14-47af-8829-80baf3e5f3f3/zulejo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16f2c0ac-d3b9-49a5-8554-bf1c1af3a31c/toshiba_tv_dvd_vcr_combo_manual.pdfIn PDF document text
- http://zafazemebotege.rf.gd/varineniva.pdfIn PDF document text
- http://zideniniwos.epizy.com/graphical_method_of_adding_vectors_worksheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a76efd89-d85d-4179-ad27-bd2f723eb911/88107255197.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1203dc9c-e4a6-49d4-be53-3828e3adba55/hp_6940_printer_error_lights.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd141cf8-ef90-4cb9-8b98-7e4792f7ff20/zowojajevuzoxelizi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/27b30866-afd6-4d1a-b22c-610c27619cb3/bofuxip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2cb13d6-5a96-4b1a-9e41-13176201f855/kusugidilidunipakalulu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4dea570d-b1a6-4285-8408-8de61799846e/applied_linear_algebra_4th_edition_slader.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010228.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10228 | 5524 bytes |
SHA-256: 4c801f0cc95377b6a0cac85cd11756fc38ef41400578d9260084c0767e5d2c13 |
|||
font_01_sfnt_off000114c0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114C0 | 10756 bytes |
SHA-256: a54b653dac465694c9841d172ab5258f064644f459d121f160d6935fa782c804 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.