MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a significant number of external links, identified as a link farm, with one URL pointing to 'xajibur.ru'. The ML classifier and ClamAV detection strongly indicate maliciousness, classifying it as a phishing trojan. The presence of numerous links suggests an attempt to redirect users to potentially malicious sites or for SEO manipulation.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=what+are+three+elements+typically+found+in+romantic+poetry PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475995/normal_6026db40c3cbf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373999/normal_60290462c9f8f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4496193/normal_5ffbd8de2c1c5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4473049/normal_5ff0c4443c46c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409609/normal_6020d17318f81.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4500882/normal_5ff9a6a925b45.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4447252/normal_5fcd884ce530c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://putojoner.rf.gd/46969775058.pdfIn PDF document text
- https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_3f9aad89981f47a4b73a1ab32dcccac8.pdf?index=trueIn PDF document text
- https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_75dc266792734d8eb852c0daca03cb79.pdf?index=trueIn PDF document text
- https://eadb47d6-6712-4ecd-aa5a-2cdcf2d90b86.filesusr.com/ugd/c844bf_af1db1d7be1f41bb836ca4f64542114b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/baxegezivumi/cryptogenic_organizing_pneumonia_guideline.pdfIn PDF document text
- http://pukafenofi.epizy.com/late_for_work_warning_letter_template.pdfIn PDF document text
- https://99b08629-27b2-41dd-83a1-938dc2ca35bd.filesusr.com/ugd/067ecb_26e3bc3f4d154816b457b72529dc6469.pdf?index=trueIn PDF document text
- https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_a8fdb8248e504b7da52b29d33ad5a77a.pdf?index=trueIn PDF document text
- https://e0d0d77b-4c00-4265-bc22-f0cc5cf11ada.filesusr.com/ugd/957eb4_2bf0d5bc3837409480567d82dc67160b.pdf?index=trueIn PDF document text
- http://tumofif.rf.gd/bakrid_tamil_hd_movie.pdfIn PDF document text
- https://s3.amazonaws.com/janodojivi/1696741756.pdfIn PDF document text
- https://a4346b84-4611-49ab-b113-80c9188ca613.filesusr.com/ugd/078c79_678a2a5b305c4fecaabf2010ff58f466.pdf?index=trueIn PDF document text
- https://a32e93c2-1aa3-4149-af29-aa5d163ab988.filesusr.com/ugd/40336e_d2480d9edcaa4e4cbc528f3192e97c21.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000112dc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112DC | 2900 bytes |
SHA-256: 40ce0bc9b113ef031639604f059b60aa9f1e41b097d60e75bfbf620cccc66306 |
|||
font_01_sfnt_off00011d20.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D20 | 5508 bytes |
SHA-256: 1613b4e1944c026710386f0f9a1ac0a8f8e6066942f459ff449b579119ee0b47 |
|||
font_02_sfnt_off00012fc5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12FC5 | 10692 bytes |
SHA-256: 7918918423109a870f1bc9eee5c923adb6e9d631cc6ba42bb486d12a53a83386 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.