MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a heuristic firing for a link farm, suggesting it is designed to drive traffic to external sites. The embedded URL `https://jumiwimov.ru/strik?utm_term=what+type+of+oil+does+a+ryobi+power+washer+take` appears to be a lure, disguised by the document body's seemingly innocuous search query. ClamAV detection as `Pdf.Phishing.Trojan` further supports its malicious nature. No scripts were extracted, but the PDF structure itself facilitates the redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=what+type+of+oil+does+a+ryobi+power+washer+take
- https://mutoxikaxinabab.weebly.com/uploads/1/3/4/8/134886861/33251144085.pdf
- https://cdn-cms.f-static.net/uploads/4377647/normal_605ff069d7183.pdf
- https://cdn-cms.f-static.net/uploads/4367656/normal_604b035d68b7d.pdf
- https://cdn-cms.f-static.net/uploads/4452834/normal_600b24528e671.pdf
- https://cdn-cms.f-static.net/uploads/4486200/normal_604fe3fc1faab.pdf
- https://lodarexuxune.weebly.com/uploads/1/3/4/3/134352809/kowejas.pdf
- https://zogetomobosuzo.weebly.com/uploads/1/3/4/7/134741576/54b7acf601.pdf
- https://cdn-cms.f-static.net/uploads/4415304/normal_60464ac16b9d0.pdf
- https://megidawuxuta.weebly.com/uploads/1/3/4/7/134729580/6846268.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/e4ef8435-4d47-4e02-9b09-7e525dca4737/romeo_and_juliet_act_1-2_quiz_answer_key.pdf
- https://s3.amazonaws.com/lebejos/ieee_photonics_technology_letters_latex_template.pdf
- https://uploads.strikinglycdn.com/files/3f2109dd-b5ad-4b91-8867-6bedb5fdbe26/3._my_system_by_aron_nimzowitsch.pdf
- https://uploads.strikinglycdn.com/files/f35f9f41-81b0-4590-987f-3896df97d836/advanced_vb.net_programming_tutorial.pdf
- https://uploads.strikinglycdn.com/files/bc102768-dd7f-4220-81ec-23013533a382/mackie_profx22v2_22-channel.pdf
- https://uploads.strikinglycdn.com/files/3abab266-5069-4847-bf4d-dd557011e2d6/kanso_sound_processor_cp950.pdf
- https://s3.amazonaws.com/lunojol/backtrack_5_apk_free.pdf
- https://s3.amazonaws.com/tidigudetefumof/force_and_motion_worksheets_answer_key.pdf
- https://s3.amazonaws.com/xeroguru/metodologia_de_la_investigacion_sexta_edicion_uca.pdf
- https://s3.amazonaws.com/gifojuxaxeva/bidugurumavixamofigu.pdf
- https://s3.amazonaws.com/wibadinavosunom/adobe_character_animator_32_bit_free.pdf
- https://s3.amazonaws.com/lunojol/35246369828.pdf
- https://s3.amazonaws.com/xofalepelala/damefalimuvonizol.pdf
- https://uploads.strikinglycdn.com/files/ed3b0aef-dcca-4d49-8a11-2ae4a86af4f4/kenox.pdf
- https://uploads.strikinglycdn.com/files/7f5dca8d-f4d0-451a-9777-69fb1ed6b585/what_are_the_best_certifications_to_have_for_cyber_security.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e02b.bin0a03ad1db3cf57a8ab12bd38dcf8beb30193615db69780d47337405bf2709109 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE02B | 5540 bytes |
font_01_sfnt_off0000f318.bina760033e65b7a21197d808455e431701a0bee5e82a16c5062fbbe4a1930a0e53 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF318 | 10396 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.