MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF with a high ML classification and ClamAV detection, indicating malicious intent. It contains numerous embedded URLs, with at least one, 'https://jumiwimov.ru/strik?utm_term=pcf+to+kn%252Fm3+calculator', appearing to be a lure for a calculator tool. The PDF's structure and the presence of many links suggest it functions as a link farm or a phishing document designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=pcf+to+kn%252Fm3+calculator PDF link annotation
- http://rexevivejegox.scienceontheweb.net/xuxabi.pdfIn PDF document text
- http://chuvashovfamily.ru/minecraft_3d_printer_fileszlush.pdfIn PDF document text
- http://lojapidabud.mypressonline.com/gefutodovoniziluratiku.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478687/normal_5fd9a89eca546.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464700/normal_5ffa86ac96c0f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403540/normal_6017b2290266d.pdfIn PDF document text
- http://mobufuwiwid.medianewsonline.com/what_does_an_encoding_failure_mean_in_terms_of_memory.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368225/normal_601ef5d2c37fe.pdfIn PDF document text
- http://lotto-investclub.com/centrelink_forms_nomineegbzbj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://japinoxizidunub.myartsonline.com/how_to_remove_adt_panel_from_wall.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac577c00-14dd-4cfb-a84e-36404d149815/jegadesekelusegipolubamu.pdfIn PDF document text
- https://s3.amazonaws.com/divikufifir/dagebulelowefez.pdfIn PDF document text
- https://0d525c28-a295-4f23-9015-da00738c1840.filesusr.com/ugd/c4ccc4_d73f16410b674ac2aa93460ea2ea8c2f.pdf?index=trueIn PDF document text
- https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_d315b458b8ba4906b589a35efaa3de50.pdf?index=trueIn PDF document text
- https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_43f2ee0a4a8146b582554b27ed9142c8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/854ee55c-ef5b-47fc-9824-28fe6eaf6fe8/bigger_leaner_stronger_calculator.pdfIn PDF document text
- https://s3.amazonaws.com/jirebonudur/wugobegokamogezojoma.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1c0344ea-c59b-4863-9c83-464bc35c4a27/how_to_plot_velocity_vs_time_graph_in_excel.pdfIn PDF document text
- https://s3.amazonaws.com/pusolefosex/29130402436.pdfIn PDF document text
- https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_9018db450e5b4bf7b381ffa40a3ee7bf.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fotepopunaj/also_sprach_zarathustra_deodato_sheet_music.pdfIn PDF document text
- https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_06270dd0966f4206ba959f3549e484c9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d1ba7038-1823-4435-9fd0-2400bae8d54d/bolegogijulezowokusazuxil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fef1b956-81b5-45ad-9c36-5348f8e83519/casio_calculator_hr-100tm_user_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e655.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE655 | 5112 bytes |
SHA-256: 41ce5400f90bba07acb7a4cf81c49607168973f982a5be9ce16ba2bf10f9d674 |
|||
font_01_sfnt_off0000f7b7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7B7 | 10744 bytes |
SHA-256: ea00d2f8be068c11073d67f693d494c76b898cf0c9e9c140eded2597c25d15c9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.