MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics and an ML classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous embedded URLs, with at least one, `https://jottigo.ru/strik?utm_term=boy+scouts+uk+near+me+eugene`, pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to 'boy scouts' and includes application metadata, indicating it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9963
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/strik?utm_term=boy+scouts+uk+near+me+eugene PDF link annotation
- http://ourfutures.space/android_9_call_recording_without_root9i7wk.pdfIn PDF document text
- https://faluwesidiji.weebly.com/uploads/1/3/0/7/130738597/5642129.pdfIn PDF document text
- https://vuvuzuvikedatun.weebly.com/uploads/1/3/4/5/134529562/d7f6e285478.pdfIn PDF document text
- https://zotejukewas.weebly.com/uploads/1/3/5/3/135347558/6ef11818aed3b6.pdfIn PDF document text
- http://glawerry.online/15422759518in7e0.pdfIn PDF document text
- https://notagudoda.weebly.com/uploads/1/3/0/7/130776089/ed7069652cfdf55.pdfIn PDF document text
- http://nugitesa.iblogger.org/jesus_bleibet_meine_freude_violin.pdfIn PDF document text
- http://dowowuvaz.iblogger.org/katlicherra_hailakandi_weather_report.pdfIn PDF document text
- http://blu-ital.space/hurt_feelings_report_funnycib8r.pdfIn PDF document text
- https://gawajofanobovap.weebly.com/uploads/1/3/5/2/135296378/nujalizinonena_meposefavu_mipagurofu_rudobal.pdfIn PDF document text
- http://idealica-uficiale.website/28558607164b08lw.pdfIn PDF document text
- https://xizikako.weebly.com/uploads/1/3/0/9/130969027/jisabaxupiba-difasog-varexeje-lavuxodamere.pdfIn PDF document text
- http://bapitafi.22web.org/witatupajujabupox.pdfIn PDF document text
- https://viwalamul.weebly.com/uploads/1/3/3/9/133997630/1271342.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://rasiwimuweb.epizy.com/rasarolugago.pdfIn PDF document text
- https://30bb9d03-04f1-4043-8ca4-b11f08dd7d37.filesusr.com/ugd/82ab19_34912062e28544bf9ba6dd1cdfa7254c.pdf?index=trueIn PDF document text
- http://regipikiwubadov.epizy.com/libro_cazadores_de_microbios_gratis.pdfIn PDF document text
- https://1b65b899-5fad-42bd-af9e-a3fb1d6a4c80.filesusr.com/ugd/a2ebd8_2c09e6dae31744b7b8a77c30d90ea588.pdf?index=trueIn PDF document text
- https://36d3fe4d-ce77-4ecd-ae21-04b42370c250.filesusr.com/ugd/871c54_f63beb458d944d6880ae290b9fd9d439.pdf?index=trueIn PDF document text
- https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_d58fcf5dd15b4ff3bcd3c94c6aeaeb1b.pdf?index=trueIn PDF document text
- https://b595a6f9-6bcb-48d8-acfc-7cb8c696cf55.filesusr.com/ugd/21f311_ff6dc1827ba04937bea193e3f95fb7c4.pdf?index=trueIn PDF document text
- https://883cd1dc-02d0-4059-8fa2-99201f92b631.filesusr.com/ugd/6166c9_048341726afc4ed8b167ad07d9829c67.pdf?index=trueIn PDF document text
- https://8e0cabef-d481-4215-b437-8a5fc4e4723c.filesusr.com/ugd/f41140_aca2be5c973d464aabe43d7ba4e3b66c.pdf?index=trueIn PDF document text
- https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_8075811273854b319603d05db890b204.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00026864.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x26864 | 5304 bytes |
SHA-256: d0b9a5bdfe2b9ffea2247c14e7dc060997ffc3e14c328f7aa430dfbfe61c05d6 |
|||
font_01_sfnt_off00027a6e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x27A6E | 12032 bytes |
SHA-256: 555a7bd852c8ab76404077f1070a3f78397c23a99dbb3b3aea69f9610eef236b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.