MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document uses an image lure related to 'Darkest Dungeon Android 2019' to trick users into clicking a link. This link, https://jacksth.ru/123?utm_term=darkest+dungeon+android+2019, is identified as an SEO redirector for phishing, likely leading to a malware download or further phishing attempts. The PDF structure itself contains embedded JavaScript, which could be used to facilitate the redirection or exploit vulnerabilities.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/123?utm_term=darkest+dungeon+android+2019 PDF link annotation
- https://cdn.sqhk.co/rugugojeba/ojagc0a/naija_highlife_music_mix.pdfIn PDF document text
- https://cdn.sqhk.co/zitibidino/jH93hib/timiwosaguro.pdfIn PDF document text
- https://cdn.sqhk.co/gaxobenona/bsifibO/skyblock_addons_download_1._16._1.pdfIn PDF document text
- http://senorifeg.iblogger.org/goledajeratem.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/a9b16218-892a-46c4-a032-49353c98f683/18006977585.pdfIn PDF document text
- http://gesorowar.rf.gd/xagixofe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9119962e-cf62-4381-8104-6d7d39ecaa03/ultimate_mortal_kombat_sega_genesis_cheats.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77233ca2-7b31-467f-a1c6-eb5edc8796b2/printable_timesheet_template_free.pdfIn PDF document text
- https://s3.amazonaws.com/wivunonovef/luvematavezuxaro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3372103-c8a7-41bc-a643-64a014684754/who_services_heat_and_glo_fireplaces.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6870e675-8454-4679-b220-fb2ba35a19fb/gegoferawikopokobi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7741afe4-9bb8-4ed1-ad14-0e2cea6f4498/xamawarokabobes.pdfIn PDF document text
- https://s3.amazonaws.com/somamere/jigumerawoxotawumurik.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5f29381-9e17-4e00-81f4-cc9983f1a458/20573539906.pdfIn PDF document text
- https://s3.amazonaws.com/feborobegibew/75573034122.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d202c09f-024d-4440-a300-1be4bc2513f0/starbucks_cold_cups_personalized.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/531ed856-05c0-46c4-9422-1f1c4eb751ee/compare_and_contrast_prokaryotic_and_eukaryotic_cells._give_specific_examples_of_each.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/495ebe6f-d512-4cba-9c79-3b121f3bf62b/como_realizar_una_ficha_bibliografica_ejemplos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9304ca85-7069-49f1-a9ee-3e497ff9d3c1/migejigizivos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fba33136-0b5c-4f6b-9ef6-9ea31e613897/juvolaxatokofirutuxezi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eed7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEED7 | 5388 bytes |
SHA-256: 1e13e85e6ea816b3b9b9a3fb8f919b915ebdd29aff4c347bc1decc4519ea7e2e |
|||
font_01_sfnt_off0001013f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1013F | 10780 bytes |
SHA-256: fa126965f8e69da945bac9ab65e2b03f57c25f36fdd4de9f6b52cb8a225100e3 |
|||
font_02_sfnt_off00012640.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12640 | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.