MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of numerous external URIs, including those on disposable hosting and potentially used for redirection, strongly suggests a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains strings that appear to be part of a lure, such as 'Navy eval writing example'. No scripts were extracted, but the PDF structure itself facilitates linking to external resources.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/aws?utm_term=navy+eval+writing+example PDF link annotation
- http://jigikujed.scienceontheweb.net/pelijariresus.pdfIn PDF document text
- http://lebuvowune.getenjoyment.net/33087053417.pdfIn PDF document text
- http://wunadimizurened.medianewsonline.com/55932407745.pdfIn PDF document text
- http://hookup666.site/corporate_responsibility_sustainability_report_airbusd0s9m.pdfIn PDF document text
- https://cdn.sqhk.co/bojowagawire/fgQWBM1/37474584566.pdfIn PDF document text
- https://cdn.sqhk.co/vaminika/hf1PCjh/horizon_hobby_tech_support_email.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373008/normal_601559caa8a2d.pdfIn PDF document text
- http://tikovg.xyz/immanuel_kant_philosophy_of_self_summarys0865.pdfIn PDF document text
- http://pojapir.mygamesonline.org/modele_attestation_d_emploi.pdfIn PDF document text
- https://cdn.sqhk.co/supesuvepo/6MPDiiT/rojebuxovitumapovimiwul.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475577/normal_5fc69235bc904.pdfIn PDF document text
- https://cdn.sqhk.co/fafaviwi/bihfwPQ/pejedelimilabuzabuder.pdfIn PDF document text
- http://jofigapowewumaw.22web.org/64559425366.pdfIn PDF document text
- http://bibopasaxuvibu.mypressonline.com/xogejebazur.pdfIn PDF document text
- http://takudogifox.22web.org/family_meeting_agenda.pdfIn PDF document text
- http://kiloritijuxat.iblogger.org/56014872314.pdfIn PDF document text
- https://cdn.sqhk.co/vewimidipiv/EPhepjg/filosofia_del_entendimiento_andres_bello.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://bejiteviv.epizy.com/botonosigewaxizomataz.pdfIn PDF document text
- https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_54bed7135d0d412db833be8155644bc1.pdf?index=trueIn PDF document text
- https://dab7fb03-f2af-4a8e-9cb9-31de623bedb3.filesusr.com/ugd/58b596_7b1c83b174954c478602f5df348955f3.pdf?index=trueIn PDF document text
- https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_c44e14468fad42c7adbc37f6a1c7806b.pdf?index=trueIn PDF document text
- https://2dcb0092-dd22-4cef-90c1-8c398f802bb7.filesusr.com/ugd/ff3115_439c56283972465a9772cb11bc1d6fc7.pdf?index=trueIn PDF document text
- https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_ab994ea531e54fadba6919812cdebb5d.pdf?index=trueIn PDF document text
- http://towilisok.epizy.com/conair_clipper_guards_2_inch.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015d84.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15D84 | 5252 bytes |
SHA-256: ce5f2e8bdf4c445dff08f2307c6999f677cd7575012c4317a1f20b85a62cbd5d |
|||
font_01_sfnt_off00016f73.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16F73 | 11596 bytes |
SHA-256: 87a123afe51bbcb586c64e71f0ae928bab0911dcd30535877d83baf888c4c076 |
|||
font_02_sfnt_off00019701.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19701 | 16204 bytes |
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.