MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting it's part of a link farm or SEO spam operation. The primary URL, https://xezojetit.ru/wix?keyword=a+walk+in+the+desert+reading+street+pdf, is likely a lure for phishing or to drive traffic to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/wix?keyword=a+walk+in+the+desert+reading+street+pdf
- https://juxusuvib.weebly.com/uploads/1/3/0/7/130739690/9269468.pdf
- https://cdn.sqhk.co/negapevu/RjaAgfD/tuwirovosuz.pdf
- https://dexulivixuwe.weebly.com/uploads/1/3/0/7/130739852/4754835.pdf
- https://cdn-cms.f-static.net/uploads/4491688/normal_6026df9b29d32.pdf
- https://cdn.sqhk.co/kupibetefuko/XLFrP18/zuferuxurozixatatifigur.pdf
- https://tefegori.weebly.com/uploads/1/3/1/6/131637168/tivakeki.pdf
- https://gojamomajaso.weebly.com/uploads/1/3/4/6/134616238/2927644.pdf
- https://sodefabufu.weebly.com/uploads/1/3/4/4/134473286/zejizokepok_dinitifebexox.pdf
- https://musigimipipo.weebly.com/uploads/1/3/4/4/134470090/8017625.pdf
- https://cdn-cms.f-static.net/uploads/4419452/normal_601beb852426c.pdf
- https://jizotigop.weebly.com/uploads/1/3/0/8/130874082/1c8d2.pdf
- https://jotipipadazazo.weebly.com/uploads/1/3/4/3/134319758/runubutikonubufu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/95182e69-e672-450d-8a24-320f337ed053/aprendizajes_clave_preescolar_lenguaje_y_comunicacion.pdf
- https://uploads.strikinglycdn.com/files/3ca0bc8c-11f2-4305-aed9-d936d6d54109/ncees_fe_civil_practice_exam.pdf
- https://dd907c4b-492b-4b4d-bf3c-9f0b7a2bd2c7.filesusr.com/ugd/96a426_73a1d4337c9c4b879e7c3c06cc6b7e17.pdf?index=true
- https://e6b56e3c-1b88-4cfb-972d-ab1702b0a06e.filesusr.com/ugd/8c0e65_2ecf0b60cd524e38a2f7f6748dab326c.pdf?index=true
- https://uploads.strikinglycdn.com/files/ab7b9e13-a927-4a0d-8699-a62a3ea5eda0/robert_graves_greek_myths.pdf
- https://uploads.strikinglycdn.com/files/286ae9f2-3660-4435-8ec2-0136b6857a06/translation_worksheet_math_aids.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010838.bina606a6dede3b99472d2ac97761204782646b5f75106b48d1abccbe9a99ca9a4c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10838 | 6440 bytes |
font_01_sfnt_off0001182c.bin3abe6871687306c07602723919f41a53571d0cd7413504f39d1af327ee28728f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1182C | 5448 bytes |
font_02_sfnt_off00012ac1.bin8cc5c816f0768036e4c9a2853df9fec88e514b792f74fd37165836a3ff2d4e63 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12AC1 | 12108 bytes |
font_03_sfnt_off000152ee.bin416438fd0a6bf2b0fbbee90b75bae1eaaf4cf69236eda9052fd3a4450d1d3b12 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x152EE | 16096 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.