MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous embedded URLs, many of which are hosted on disposable domains and appear to be part of a link farm. One prominent URL, 'https://xezojetit.ru/strik?utm_term=how+to+reset+the+yamaha+receiver', suggests a phishing or scam attempt by disguising malicious content as helpful information. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9975
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=how+to+reset+the+yamaha+receiver PDF link annotation
- https://lemevepavakupe.weebly.com/uploads/1/3/4/7/134701524/gururi.pdfIn PDF document text
- http://senteber.site/anhalteweg_reaktionsweg_formely8wb0.pdfIn PDF document text
- http://smcjd.com/91133092956npkp5.pdfIn PDF document text
- https://cdn.sqhk.co/kigaratak/ahjiige/cubic_boxing_3d.pdfIn PDF document text
- http://punexom.22web.org/risk_management_plan_template_nsw.pdfIn PDF document text
- http://kernig.store/machine_learning_and_ai_jobs_in_indiajesmr.pdfIn PDF document text
- http://espaceclient-cmb.com/figurative_language_test_and_answers3dr4r.pdfIn PDF document text
- https://cdn.sqhk.co/vetelojid/iiSetqJ/anestesia_raquidea_tecnica.pdfIn PDF document text
- http://sosed.market/holt_mcdougal_united_states_history_textbooknlb3z.pdfIn PDF document text
- http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdfIn PDF document text
- https://cdn.sqhk.co/letarezetap/PibLjcP/clothes_worksheets_clipart.pdfIn PDF document text
- http://sitajejo.22web.org/70561256122.pdfIn PDF document text
- https://xebigami.weebly.com/uploads/1/3/4/6/134661154/xefusakakisove.pdfIn PDF document text
- http://sk-anker.ru/734827671020xx70.pdfIn PDF document text
- http://habercigo.com/e-myth_worldwide_reviewsbzrgd.pdfIn PDF document text
- http://biomanix.best/homelite_blower_service_centerswh0y9.pdfIn PDF document text
- https://zunimivivonuz.weebly.com/uploads/1/3/4/0/134017399/7539025.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://vitupofelomar.epizy.com/gasenixid.pdfIn PDF document text
- http://tumajazumi.rf.gd/flight_pilot_simulator_3d_free_mod_apk.pdfIn PDF document text
- http://jilizowo.rf.gd/the_crown_netflix_series_5.pdfIn PDF document text
- http://togipumenotu.epizy.com/arcade_game_emulator.pdfIn PDF document text
- http://rajixubododafu.epizy.com/arizona_cardinals_injury_report_week_5.pdfIn PDF document text
- http://zuvolape.epizy.com/what_happens_if_water_heater_pilot_light_goes_out.pdfIn PDF document text
- http://lesexugisitu.rf.gd/18511201373.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa23.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA23 | 4904 bytes |
SHA-256: 9f5eb3c5b961a05dad842e97785bf109119ecbf44b5c00771cdbad066bab4e73 |
|||
font_01_sfnt_off00010ade.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ADE | 1648 bytes |
SHA-256: 8170fc3fc409a1c0877eb8fc97c1aa6793fdaed6054e537339186737bbbebbfb |
|||
font_02_sfnt_off00011321.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11321 | 13120 bytes |
SHA-256: 964d586b9e8574de16245a5194d707093179f6a7eecd8acdbb4bf7b9896f9afa |
|||
font_03_sfnt_off00013e3b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13E3B | 16488 bytes |
SHA-256: 1f283ad1807b978d6e5052b77c85f2d1ee8355f09edf69677a6be6b2390b50b1 |
|||
font_04_sfnt_off000154a0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x154A0 | 4324 bytes |
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.