MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external links, with one pointing to 'https://golowaki.ru/strik?utm_term=isotopic+abundance+practice+problems+answer+key', suggesting a phishing or malicious content distribution attempt. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, hinting at its generation method and time. No scripts were extracted from this sample, but the overall structure and heuristic firings strongly suggest a phishing or malicious content delivery vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=isotopic+abundance+practice+problems+answer+key
- https://cdn-cms.f-static.net/uploads/4408996/normal_603deba0b1b81.pdf
- https://gelasinez.weebly.com/uploads/1/3/4/7/134763890/fofepuzuvubefaz-wolunowenava-rigogox-benunero.pdf
- https://fakanodadix.weebly.com/uploads/1/3/4/3/134371587/pakoti_tumudamosakux.pdf
- https://cdn-cms.f-static.net/uploads/4450630/normal_5fdaae1c1f73e.pdf
- https://cdn-cms.f-static.net/uploads/4416305/normal_60250cecaa3fd.pdf
- https://deriwofapavuz.weebly.com/uploads/1/3/4/3/134311795/1960729.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/dagasopones/mayo_clinic_antimicrobial_therapy.pdf
- https://s3.amazonaws.com/roware/javascript_substring_vs_slice_performance.pdf
- https://s3.amazonaws.com/gurafoga/windows_key_commands_for_mac.pdf
- https://s3.amazonaws.com/pafexegud/wexitojugava.pdf
- https://s3.amazonaws.com/jijumupade/36292713180.pdf
- https://uploads.strikinglycdn.com/files/8777d7b4-f232-46aa-9556-9e1d7fa37000/fisher_paykel_refrigerator_parts_diagram.pdf
- https://s3.amazonaws.com/tezude/51161657571.pdf
- https://uploads.strikinglycdn.com/files/8407cf99-3a7a-42cd-9c21-75b764933f91/17705547704.pdf
- https://s3.amazonaws.com/kelukakeb/tagutepilitogevudajoduki.pdf
- https://s3.amazonaws.com/rujimidujek/adare_poojaneeyai_dj_song.pdf
- https://s3.amazonaws.com/dovulavavo/nubobolaxixes.pdf
- https://s3.amazonaws.com/wuzalugiseto/matlab_guide_clear_axis.pdf
- https://uploads.strikinglycdn.com/files/cba2a544-f934-451c-9438-06af429c8a8e/63384640987.pdf
- https://s3.amazonaws.com/lonozote/what_is_the_function_of_a_piston_in_an_internal_combustion_engine.pdf
- https://uploads.strikinglycdn.com/files/c6d80704-a757-4935-88f6-3c6786a27886/remington_700_sps_detachable_magazine_upgrade.pdf
- https://uploads.strikinglycdn.com/files/f3097f3c-aa7a-4196-a964-3b558bd654f4/vulapuro.pdf
- https://s3.amazonaws.com/bulolimepol/math_answers_to_all_problems_for_free.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010079.bin7c1d5e844ecbbdf9f90873cf04e3982a9da626c1027965b4c2b1f42d26c81dd2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10079 | 5556 bytes |
font_01_sfnt_off00011357.bin9b0cc9a3d2f67418a578daacf5467f8620d90c1454eaeb237889800e7f8ca392 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11357 | 11564 bytes |
font_02_sfnt_off00013b0c.bin2173a1880e9f774f759393e7d0d28dda91d04d8a3eae6bea41b822770b343b90 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13B0C | 16060 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.