MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, identified as a link farm, pointing to various PDF documents. One prominent URL, 'https://xezojetit.ru/strik?utm_term=which+is+the+best+online+english+speaking+course', is directly embedded and likely serves as a lure for phishing or malware delivery. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=which+is+the+best+online+english+speaking+course
- https://static.s123-cdn-static.com/uploads/4484633/normal_5ff64b32a3d2e.pdf
- https://zabaparadasikid.weebly.com/uploads/1/3/4/3/134317604/932d62c279b2e03.pdf
- https://cdn-cms.f-static.net/uploads/4375355/normal_6052eb014190c.pdf
- https://sapemeke.weebly.com/uploads/1/3/2/8/132814969/lekanevotiminuv_tikupemo.pdf
- https://cdn-cms.f-static.net/uploads/4487927/normal_6063c9ef7ab4b.pdf
- https://cdn-cms.f-static.net/uploads/4486550/normal_6044a00d556b3.pdf
- https://minaraxu.weebly.com/uploads/1/3/4/7/134765114/suwogajegel.pdf
- https://rogewakaz.weebly.com/uploads/1/3/2/8/132815912/9e7516d27.pdf
- https://segurawunazuzi.weebly.com/uploads/1/3/1/3/131381703/5449286.pdf
- https://cdn-cms.f-static.net/uploads/4445534/normal_604d2475b4583.pdf
- https://fimizugowukabi.weebly.com/uploads/1/3/1/1/131164572/tozazijapupetari.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/ef84040b-d781-4558-9ffe-0db5846e2bbd/brother_hl-2170w_reset.pdf
- https://uploads.strikinglycdn.com/files/74bb01d8-f182-4780-bebf-e4a0cdca56ee/yamaha_rx-v463_manual.pdf
- https://uploads.strikinglycdn.com/files/3f533ed0-9552-410b-9dc0-a15b229b449f/difference_between_roku_stick_plus_and_ultra.pdf
- https://uploads.strikinglycdn.com/files/65efa214-9026-4616-8650-7fd88be54b5a/why_does_my_oscillating_sprinkler_get_stuck.pdf
- https://uploads.strikinglycdn.com/files/ec6d4a36-5361-4f61-996b-f6f34b179d6b/60278403276.pdf
- https://uploads.strikinglycdn.com/files/d1818107-ccda-4a22-8dc9-9361cc9d92e9/68825076886.pdf
- https://uploads.strikinglycdn.com/files/a577b68d-39f5-49cd-b21b-162c44fb4a40/44920123255.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f61c.bin16eb57718c258427d951e7a3e8dc7eb0b593a491d5f6c024d6cf938922264391 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF61C | 5412 bytes |
font_01_sfnt_off0001088e.bin486d0c53b25c8668f234d7b3779aae329147fb36156d6399fbcf5a63edc73a6c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1088E | 10908 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.