MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded URLs, with a primary focus on directing users to `https://xajibur.ru/123?utm_term=south+african+latest+house+music+2018`. Heuristics indicate this PDF functions as a link farm on disposable hosting, a common tactic for phishing or malware distribution. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or delivering a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=south+african+latest+house+music+2018 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4464710/normal_5fed334a2bc48.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4530712/normal_5ff24ebadf4d2.pdfIn PDF document text
- https://cdn.sqhk.co/tesosunimew/jbha2gc/junaza.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407576/normal_5fe1e901da380.pdfIn PDF document text
- https://cdn.sqhk.co/ruxuzobisu/aoHhgij/minecraft_clicker_test.pdfIn PDF document text
- https://cdn.sqhk.co/wusezofetib/2Pnjjbe/seloziwa.pdfIn PDF document text
- https://cdn.sqhk.co/wafizogep/jcitheu/dibafebewuzano.pdfIn PDF document text
- https://cdn.sqhk.co/jekunesoru/wDDkjeN/acetal_formation_from_diol_mechanism.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460466/normal_5fdd7029c6ce1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445324/normal_6027fe396d2f7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fesonukoropirum.rf.gd/19746758620.pdfIn PDF document text
- https://s3.amazonaws.com/petubapizo/how_to_use_the_nato_phonetic_alphabet.pdfIn PDF document text
- https://506dbbd1-d4b3-44b1-a4c9-6b5d0cab6a23.filesusr.com/ugd/c75f60_75003570f510442894920c82e1c6582f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/paxunu/animal_exposure_report_form.pdfIn PDF document text
- https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_6973ff84a45e4512afcbe00597b67156.pdf?index=trueIn PDF document text
- http://wazaralod.epizy.com/advance_butterfly_valve_catalogue.pdfIn PDF document text
- https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_eed6c02ff49d4fc79d424978dffdd675.pdf?index=trueIn PDF document text
- https://2e4d99de-9d37-4ce2-abd5-0bbccafdbe51.filesusr.com/ugd/33a2e4_0ae3ba0796ee4604bfeac5eaf7dedd58.pdf?index=trueIn PDF document text
- https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_266ac98ca7e94b93a15dbef2e44b0a6b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ponivotigegepub/perkembangan_agama_kristen_di_indonesia.pdfIn PDF document text
- https://d4f1f58f-bd44-402a-a4b0-a3aa01e36dbf.filesusr.com/ugd/dffefa_a1333e2cdbdf4547b75414dde2d3a562.pdf?index=trueIn PDF document text
- https://5a995288-ce6f-4ae3-a3e6-14272d8003db.filesusr.com/ugd/7be1cd_7d4fbccf96424097ac0fd0db1ab76e96.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f190.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF190 | 5744 bytes |
SHA-256: 361798931a5fc40fd809a29867f894a30803ac75ba2e0d20956a4710528311a3 |
|||
font_01_sfnt_off000104f7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104F7 | 10928 bytes |
SHA-256: ac2b749af781feca6c93463ebcef0e77f0259b6fc477d8068e12dfcef1ebb7d7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.