MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting it functions as a link farm. The primary malicious URL identified is https://xezojetit.ru/strik?utm_term=case+study+proposal+format, which is likely used to redirect users to further malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=case+study+proposal+format PDF link annotation
- https://cdn.sqhk.co/narobalof/jDhhwub/52965855071.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495240/normal_5ff0845366b2f.pdfIn PDF document text
- https://cdn.sqhk.co/fodibaniwe/ibgjjei/download_lep_s_world_2_mod_apk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449009/normal_6030e35844833.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/caa31a7f-9774-417e-bb5d-22fdebe9d2a4/60231753621.pdfIn PDF document text
- https://s3.amazonaws.com/geraromu/ligodelazepogolal.pdfIn PDF document text
- https://s3.amazonaws.com/sirilagewuga/metrics_and_measurement_worksheet_answers_physical_science.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28c8ce56-2450-4c10-a64d-34c3d03f98c3/2500_cad_to_gbp.pdfIn PDF document text
- https://s3.amazonaws.com/bisute/2766764712.pdfIn PDF document text
- https://ae9cd3fc-a2ed-4114-aa96-dd53a7e96ab4.filesusr.com/ugd/22cbe6_56303eb018914843910c61e1ee2e3fc3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2f88ea87-8019-477e-bcb2-bbdff449fcb4/dirk_gentlys_holistic_detective_agency_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e074dd71-3ab4-42f0-8e04-9d6781465deb/the_preachers_outline_and_sermon_bible_niv_-_new_testament_3_vols.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e3801a5-2eeb-41b8-8de1-53714e78fdf1/stihl_bg_86_carburetor_diagram.pdfIn PDF document text
- https://9e2901ea-5d25-41a5-867c-54d0774c6e48.filesusr.com/ugd/4d0f37_d04877043fad4165b758b9360e31aa1e.pdf?index=trueIn PDF document text
- https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_ab256a193c314612977116be0ee5ae0f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/dcd4d3d5-4458-4905-80f9-e8035516472a/50175389363.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/584b28f6-d42d-4198-8f80-6c3f4c7abc66/ls_dyna_keyword_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/319d7d2b-629e-45a4-8e72-690f992da35b/how_many_quarts_of_oil_does_a_honda_rancher_350_hold.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5b693bb-c352-46a2-bd08-b7e47fd071e3/nigerian_navy_training_camp_2020.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000107ca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107CA | 5196 bytes |
SHA-256: a4bfa301db9115fd55283ac46fda565de7e86476586a43ee38e81e83d508da17 |
|||
font_01_sfnt_off00011965.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11965 | 11148 bytes |
SHA-256: 08eaa7b6d08f8a3039aca7b1b1bcbe958c9dcb956f25ec7aa0d3868219828df0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.