MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to a suspicious domain, 'xezojet.ru', which is likely used to host malicious content or redirect users to a phishing site. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external links and the overall detection suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/wix?keyword=handheld+basketball+game PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475847/normal_6036220c438b5.pdfIn PDF document text
- http://sunipemumax.66ghz.com/movies_counter_inception.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387713/normal_604aa353e15c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387224/normal_60318c939f6c0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/28e798b7-d1f8-4e3f-8a3c-f25958515dbd/modern_calligraphy_alphabet_practice_sheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2a06dbdb-f238-4064-b526-1663ad8780b0/musili.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28e3a725-5669-451f-9997-95b9edd334e8/arkansas_drivers_license_real_id.pdfIn PDF document text
- http://leniwijob.epizy.com/76743136645.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b311f3d3-d8b3-4418-82a2-a1b8e700451b/busesijelosowej.pdfIn PDF document text
- http://witozarelopisi.rf.gd/67665737275.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e0a2d26-376a-407a-96d9-64385f588cc8/xatawuf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c3e355f-3eae-4899-856a-87ffa1b02682/formulas_de_geometria_espacial.pdfIn PDF document text
- http://begalokatixatu.epizy.com/gods_of_war_ps4_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc9b3593-55be-4372-b560-1361984c34fb/cuanto_es_400_gramos_de_harina_en_cucharadas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ddbceb6-11c4-4829-95ea-4f6460375ef2/dipiwazarajimowadodesal.pdfIn PDF document text
- http://lurorozowuwa.rf.gd/aprender_ingles_completo.pdfIn PDF document text
- http://vefagukolile.epizy.com/14594682746.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a0c66a8c-0486-4ca9-8874-c7fec2e290a1/network_security_basic_concepts_ppt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/647db2b7-07e9-41a6-815d-e20f102facdc/diary_of_a_wimpy_kid_the_ugly_truth_movie_release_date.pdfIn PDF document text
- http://jilevatawew.epizy.com/34474728779.pdfIn PDF document text
- http://nupawibufa.epizy.com/24637178679.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4bc361fb-3e8f-40b5-9a03-7c2f1a3d5212/dr_jekyll_and_mr_hyde_movie_2017_dvd.pdfIn PDF document text
- http://wasalesex.epizy.com/85773724854.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b0873db4-bb19-4f44-847d-19b735507e4d/oracion_al_espiritu_santo_para_sanar_la_depresion.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f73a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF73A | 5308 bytes |
SHA-256: cc6ace87717918fdb7583012dab64285e96b8bd551312832e096aab7c376bff3 |
|||
font_01_sfnt_off00010917.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10917 | 9828 bytes |
SHA-256: 0b706e69e5ac7c4561e576c0fe3c832f393cf25205e56bde8c5b44e837ba3f7e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.