MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'xezojetit.ru', which is likely used to host malicious content or redirect users to a phishing site. The PDF's structure and embedded links suggest an attempt to disguise malicious intent as a helpful document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/123?utm_term=dictionary+guide+words+worksheet+pdf PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c86491c8-a4f4-473f-8d1d-649024454ebb/selecting_text_in_ms_word_2010.pdfIn PDF document text
- http://jejosuxiz.pbworks.com/w/file/fetch/144503763/wegamimivoximodom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7b0de70-da62-4ec5-bcb6-9719a1eb3b8f/51030861603.pdfIn PDF document text
- http://molitutolu.pbworks.com/w/file/fetch/144554574/terraria_sky_base_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/685fc08c-c5aa-4810-8d22-29f85738710e/ca_568_instructions_2016.pdfIn PDF document text
- http://redejok.pbworks.com/w/file/fetch/144500889/can_could_must_have_to_exercises.pdfIn PDF document text
- http://pamotekegopa.pbworks.com/f/fnaf_4_free_download_full_version_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b32b3ce-b1b3-4518-929c-c80dd3b2d6f1/45965442156.pdfIn PDF document text
- http://guronavageba.pbworks.com/w/file/fetch/144498435/tipos_de_diodos_y_sus_aplicaciones.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c846f9f-c19e-4b53-b04a-94219a564dba/how_to_solve_maths_problems.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/676294de-afe3-462e-853c-a6575a333732/xajejosam.pdfIn PDF document text
- http://negaboxa.pbworks.com/w/file/fetch/144449031/pogofalomazavututebimo.pdfIn PDF document text
- http://zajozote.pbworks.com/f/gidanunofexefa.pdfIn PDF document text
- http://xuwuziz.pbworks.com/f/sesulazobogutenetun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/33450be3-cee4-41b2-bf03-80d32d402b69/life_of_galileo.pdfIn PDF document text
- http://lebunurivugu.pbworks.com/f/14322751238.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4315c2ca-e74f-4741-980a-5d2aca126f8c/why_is_my_water_dispenser_so_loud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ff62e55f-d8a4-4208-a156-a033c17c068f/what_are_all_the_laws_in_australia.pdfIn PDF document text
- http://funesut.pbworks.com/f/temas_de_catequesis_familiar_primera_etapa.pdfIn PDF document text
- http://xalanupuzewo.pbworks.com/f/galexogugajagijajiludi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/98ca513d-8269-4eda-93a5-7a15ded9160b/el_mundo_de_sofia_pelicula_personajes_principales.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8086c76d-f0a4-4669-b6dc-a51cf8f4f176/bakofajisifotubonofisug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/035f3b22-bf4d-4984-a169-06c57cb1b6c1/moxevav.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea4d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA4D | 5644 bytes |
SHA-256: f8db7bd2ebfdda565f276a73da490775f82840abdd72500e75e4cc3e52a95466 |
|||
font_01_sfnt_off0000fda7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDA7 | 10612 bytes |
SHA-256: f31eb9e2158c9d77be362aa56adb94c34c2aedf1d6bad374d7e26d64ccc9e057 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.