MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of a PDF_SEO_LINK_FARM heuristic suggests the document is designed to host a large number of external links, potentially for phishing or SEO spam. One of the primary external links, 'https://leonvi.ru/strik?utm_term=buy+zippo+lighter+fluid', is suspicious and likely leads to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=buy+zippo+lighter+fluid PDF link annotation
- https://xelexezeni.weebly.com/uploads/1/3/0/7/130740222/zanakene.pdfIn PDF document text
- https://xarudaxukisa.weebly.com/uploads/1/3/4/0/134018653/3787510.pdfIn PDF document text
- https://kitigenuripoduj.weebly.com/uploads/1/3/1/0/131070171/redukejuxotivapefu.pdfIn PDF document text
- https://tedifonag.weebly.com/uploads/1/3/1/1/131164063/1197105.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/326b2759-6487-4810-b902-4e5963d8389b/51712505094.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/14fd8970-970b-450f-886f-a7568440d9ed/74356930411.pdfIn PDF document text
- https://s3.amazonaws.com/xovekolamoxe/vazegusof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1b89188-d006-4f36-a7e3-ce9d2fc8f2f0/19553930598.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3476be7-f94a-48f4-ab80-1253f7718541/dd_fifth_edition_character_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f536d86-2d56-4123-bf2b-8fd32a101352/16528289501.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/425bd5b4-0fe6-4bc2-8877-43f2206b79ff/vudagepudirodojefakunexot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51006c3c-4000-443d-aecd-6fe837f7a9d6/37404935794.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44f30e41-5bb0-413e-94aa-ee87d86c3947/a_comparative_study_of_supervised_machine_learning_algorithms_for_stock_market_trend_prediction.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89494764-8837-4f1b-85e1-e47bd3ad151b/breville_bov800xl_parts_diagram.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55b43b69-17b1-48d7-9009-4c019f8529dc/rumble_fish_movie_cast.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2721f58-50d2-4c4c-8ce8-fbea381bf6cd/do_xbox_live_cards_expire_if_not_used.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8dd6cdc5-ba21-426a-95c3-c285a302a08f/7236309706.pdfIn PDF document text
- https://s3.amazonaws.com/gizonukorad/integral_calculus_for_dummies.pdfIn PDF document text
- https://s3.amazonaws.com/gewisetug/giwewiviroda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc9c1160-904b-44f6-88b6-09735a2ccc3a/ford_mustang_gt_premium_for_sale.pdfIn PDF document text
- https://s3.amazonaws.com/wujodibu/weird_scenes_inside_the_canyon_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2200ae29-e3d8-498d-a353-ba591c17ce1f/american_government_power_and_purpose_brief_fourteenth_edition.pdfIn PDF document text
- https://s3.amazonaws.com/sukobogixe/15919753912.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e72e6df7-6dc6-46a6-8c95-ebd4237f5bbe/how_to_read_a_contour_blood_glucose_meter.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000da38.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA38 | 5116 bytes |
SHA-256: dfbcdd63dfc43aaa5fd4ba085ab6876206362badabd4aadd0ee210fe971b4510 |
|||
font_01_sfnt_off0000ebb2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBB2 | 11356 bytes |
SHA-256: 31d8573440d989f7783f8c4df33a10eed7e72a7939b12a3897e2ba13758a283b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.