MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple external URIs, including one hosted on disposable infrastructure, and a heuristic flagged it as a link farm. ClamAV detected it as Pdf.Phishing.Trojan. The presence of embedded URLs and the ML classifier's high confidence score indicate a malicious intent to redirect users to potentially harmful content. No scripts were extracted, but the overall structure and URL findings strongly suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=guide+book+of+blossoms+of+the+savannah PDF link annotation
- https://suzokixuvajix.weebly.com/uploads/1/3/0/7/130776208/bikavasenin_janatexi_sepusesefuzo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389585/normal_6035de0e53922.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4471682/normal_60b0005968a92.pdfIn PDF document text
- https://gokefezenomi.weebly.com/uploads/1/3/4/0/134040807/4417738.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4475380/normal_6033d1097e413.pdfIn PDF document text
- https://jawoxaze.weebly.com/uploads/1/3/0/9/130968973/efed6d9ce5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4415770/normal_5fc6c9ef8ecab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421970/normal_5fd1c6693247c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366642/normal_605f47df2d164.pdfIn PDF document text
- https://wumifidadorubip.weebly.com/uploads/1/3/5/2/135298964/8420698.pdfIn PDF document text
- https://kozegefiseram.weebly.com/uploads/1/3/1/3/131379202/jagopa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476140/normal_60c056ac786f4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://jananevava.pbworks.com/w/file/fetch/144809769/zajaz.pdfIn PDF document text
- http://damopijos.pbworks.com/w/file/fetch/144498621/chicken_gun_for_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d33e2d0f-37a9-4f3e-9b16-ffcdc2fd4b50/brother_model_pt-80_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3983aeeb-14de-4d0d-a2d0-7ee5cfa9376e/descriptive_writing_examples_for_3rd_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/13588bf0-adc1-4da7-b58d-8c289a793515/21448854025.pdfIn PDF document text
- http://pinurakus.pbworks.com/f/how_to_do_a_sliding_knot_bracelet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/74758e94-053f-4730-8bdd-6c8b8ab92ab7/mikikal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/022f4040-8278-4a4c-b9d7-1a34f009a6ef/83343466304.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3e0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3E0 | 5348 bytes |
SHA-256: d19a2f665d6e53365e4cc014bce0f2d5e0847f5869be5326c30b2519347cd175 |
|||
font_01_sfnt_off000105f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105F6 | 11548 bytes |
SHA-256: 236342eaf7cf709aa01b89b76f31cecb8a8e3a3356be8d816a98663a7f46c96e |
|||
font_02_sfnt_off00012d71.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12D71 | 16204 bytes |
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.