MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it is likely a phishing or trojan delivery mechanism. The document contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious content. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a tactic to obscure the true destination. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/strik?utm_term=pokemon+adventures+red+manga+pages PDF link annotation
- http://baxebeteziwetu.iblogger.org/cursos_de_ingles_gratis_en_dallas_texas.pdfIn PDF document text
- http://pisazujinatef.iblogger.org/canon_in_d_major_guitar_tab.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/87a45ef2-56c5-431f-a19f-23fced90c4e1/79209264613.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1c50168a-996c-4a84-9a71-f522d943d820/21178799936.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb305324-2f82-4743-8639-842362b65b5c/netgear_prosafe_gs108pe_default_login.pdfIn PDF document text
- https://s3.amazonaws.com/lewuli/8255004652.pdfIn PDF document text
- https://s3.amazonaws.com/vazisi/84030805468.pdfIn PDF document text
- http://fuzimobikuxuta.epizy.com/allen_bradley_powerflex_4_user_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d891c37-3f4e-4184-980b-e8515b0195ff/17286348807.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b081f6b6-963d-4c0e-80dd-748c28649548/how_to_restore_corrupted_data_on_ps3.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/718c48aa-1ddb-4aef-81b8-1eabe0979ce1/order_to_read_elric_books.pdfIn PDF document text
- http://vetovolixexa.epizy.com/2302683194.pdfIn PDF document text
- https://s3.amazonaws.com/tuzakifezara/ingenico_iwl250_terminal_user_guide.pdfIn PDF document text
- http://labotiz.rf.gd/zujifefaru.pdfIn PDF document text
- http://roragopijejem.epizy.com/nintendo_ds_pink_price.pdfIn PDF document text
- https://s3.amazonaws.com/zarusegibitumet/how_to_renovate_a_mobile_home_kitchen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2400fed-acc8-4565-830b-eb94f7cb3c1d/royal_210dx_cash_register_ink_replacement.pdfIn PDF document text
- http://retuguru.epizy.com/casio_ga_1000_4aer_manual.pdfIn PDF document text
- http://vumarolewe.epizy.com/ziloxokixaz.pdfIn PDF document text
- https://s3.amazonaws.com/putelekireza/pajiwamepewasuvo.pdfIn PDF document text
- https://s3.amazonaws.com/veledabejufi/bluestacks_android_emulator_32_bit.pdfIn PDF document text
- https://s3.amazonaws.com/bajuse/academic_word_list_570.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbd21f34-217f-43e4-bf14-6068e8381b74/what_is_a_layer_2_switch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d1f2577-ff78-46ef-9df5-564a28e0bd06/6704143668.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000175d0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x175D0 | 9120 bytes |
SHA-256: 255ef6dfea4fd18b472608eb931e3eb6d13f606393910902a55930a524de0ed2 |
|||
font_01_sfnt_off00019478.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19478 | 5372 bytes |
SHA-256: cef7679efdde8e8dc077267224285281d7508ce096cb7975f61d68711b9e1d60 |
|||
font_02_sfnt_off0001a6b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A6B9 | 12056 bytes |
SHA-256: 8da15ff81d3a8553483eaef4ecf5556d7dfa8fe03563987822b9ac397ee9421b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.