MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by multiple heuristics and an ML classifier, specifically flagged as a phishing trojan. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The primary external URI observed is https://jacksth.ru/wix?keyword=nombre+del+dios+griego+de+la+guerra, which is likely part of a phishing or credential harvesting scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/wix?keyword=nombre+del+dios+griego+de+la+guerra PDF link annotation
- http://getporte.xyz/72468033388og23i.pdfIn PDF document text
- http://getveran.site/sarolibunixakaxp4jeh.pdfIn PDF document text
- http://tutavizukatafoz.22web.org/codycross_answers_group_307_puzzle_1.pdfIn PDF document text
- http://pusuwanoxanopo.22web.org/nevajaxorilebobi.pdfIn PDF document text
- http://insurancesouk.com/how_big_is_the_average_male_arm_size7fhn3.pdfIn PDF document text
- http://venolilixe.mygamesonline.org/89017183760.pdfIn PDF document text
- http://gufutaca6.xyz/1835679618427xy4.pdfIn PDF document text
- http://magnifioco.site/what_is_cleavage_furrow_in_biologynsx8s.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_998e24b9fea64f36adfe17b705faef16.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4abcaef1-6ec4-4a79-8c97-9d8710721efb/vocabulary_workshop_level_d_unit_2_answers_choosing_the_right_word.pdfIn PDF document text
- http://ziwemasux.myartsonline.com/fogezosaravuledu.pdfIn PDF document text
- https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_1484cee8213d410abfd94d4a571cb44b.pdf?index=trueIn PDF document text
- https://2a4b29e6-a790-453e-81e7-e8b9caf2c27b.filesusr.com/ugd/bf0735_647ac4ba18d3428c9217ad9b2794d11d.pdf?index=trueIn PDF document text
- http://wugetad.myartsonline.com/what_is_the_best_whitening_cream_for_dark_skin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91ec2a90-fc9f-4876-b95e-0f72c68e16f7/how_to_put_ge_oven_door_back_together.pdfIn PDF document text
- https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_46f6b558c4c5459e8a5b43083aa19fd3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cf586c12-a206-42c9-9b52-d40c77ed6750/pefoxugobiza.pdfIn PDF document text
- http://jezevenakos.myartsonline.com/ncaa_division_2_football_championship_history.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29689470-a059-4212-9879-eecad8435b34/48301163028.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3eae51b5-891d-4b50-8f95-7d394517ce84/21959016161.pdfIn PDF document text
- http://waxodomopupu.epizy.com/2020_sexiest_man_alive_nominees.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad0d3c87-c84b-4cc5-80e1-a294cf2dff5d/what_is_a_safety_plan_in_construction.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00014530.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14530 | 5256 bytes |
SHA-256: ba0d632efb3a924fcaef904bb32ce7fb0359338f507e40a84f9314fde3b8b047 |
|||
font_01_sfnt_off000156f2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x156F2 | 17992 bytes |
SHA-256: c0ad61c62006c23895444707b2b951418c74febf9aa212ab27ae7c56a9cf464d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.