MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous external URIs, including one pointing to 'zajinet.ru', which is likely part of a phishing lure. The document body, though heavily obfuscated, suggests it might be disguised as search results or informational content to trick users into clicking malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=what+is+an+example+of+a+objective+sentence PDF link annotation
- http://fenellalucynelle.info/572615589998vmkf.pdfIn PDF document text
- http://bottlechainworld.com/apc_back-ups_es_8_outlet_550va_120v_replacement_batteryouhez.pdfIn PDF document text
- http://fisuruwibowin.66ghz.com/46192180330.pdfIn PDF document text
- http://ita-women.space/zofenevosimiwaxupekztyei.pdfIn PDF document text
- http://connexion-amelii.xyz/ms_7778_ver_1.0_motherboard_drivers_downloadkczar.pdfIn PDF document text
- http://bitjoms.xyz/82500082522q084x.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8ca4363f-0a04-4708-a032-5cbae38f0fce/53141272635.pdfIn PDF document text
- https://s3.amazonaws.com/liwara/free_disney_violin_sheet_music.pdfIn PDF document text
- http://xonefepuvimami.epizy.com/the_umbrella_academy_songs_free.pdfIn PDF document text
- https://s3.amazonaws.com/teximikamukubo/game_developer_portfolio_template.pdfIn PDF document text
- https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_e4d1332b34c048ee8a8b0a3117cc5086.pdf?index=trueIn PDF document text
- https://64b67c6e-fbbd-4787-add8-9ed3e274c95c.filesusr.com/ugd/eb6612_9f2f483fcd8246918f1caec1e7fae307.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ce894825-2704-47e7-a22d-bd0754e16aad/vurebapodujabufamisij.pdfIn PDF document text
- https://s3.amazonaws.com/kozibowisenatu/samsung_galaxy_s5_troubleshooting_black_screen.pdfIn PDF document text
- https://42f4b946-f871-4f2a-a73e-6571c6569919.filesusr.com/ugd/e20521_6df58047eb0f4872b900e73064e9a299.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6f82f797-4ff3-4e49-9073-07b28240ed64/cuisinart_dbm-8_supreme_grind_automatic_burr_mill_parts.pdfIn PDF document text
- https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_737a7fdcdbab4e09b5936b01c7dcb000.pdf?index=trueIn PDF document text
- https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_98d42a114cf44a15bfd79bd72c78a5f0.pdf?index=trueIn PDF document text
- http://zuzenif.rf.gd/sieve_analysis_test_for_sand.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0bdf7a43-6fa2-47db-a102-565f6f81c06d/69340839482.pdfIn PDF document text
- https://s3.amazonaws.com/zepifudoxapo/phonics_review_worksheets_grade_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b683b51-5fdf-4e16-a644-4bc2458a3242/64577677338.pdfIn PDF document text
- https://s3.amazonaws.com/gidibesuxi/dizukugunit.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef78.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF78 | 5516 bytes |
SHA-256: 59062f21ddca1d74613b457f303248fdd4372968ba4e27050804a4ab8de3d382 |
|||
font_01_sfnt_off00010232.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10232 | 10580 bytes |
SHA-256: cd180c0f37116de339f70b5927fa1e39791fa2f5c820b3cc9b3e4dfdc470e843 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.