MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable hosting or link farms, suggesting a malicious intent to manipulate search engine results or distribute further payloads. The ClamAV detection and ML classifier strongly indicate maliciousness, with the primary URL being a potential entry point for further compromise.
Machine Learning
- Nyx PDF Classifier malicious score 0.9960
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=sex+offenders+near+me+map PDF link annotation
- https://xidokuwu.weebly.com/uploads/1/3/1/4/131453793/voboweji-voniwebumufo-zubutadededodi-todomokuwef.pdfIn PDF document text
- https://venireza.weebly.com/uploads/1/3/5/9/135959939/betetusabif_bosisidonidepo_nexeturibexok.pdfIn PDF document text
- https://potijesidademut.weebly.com/uploads/1/3/4/3/134351663/ff68738.pdfIn PDF document text
- http://gawudubigojan.getenjoyment.net/97033932997.pdfIn PDF document text
- https://nokajadum.weebly.com/uploads/1/3/4/8/134887388/letodonogav_panukuperesuzir_sixinasupegow.pdfIn PDF document text
- https://janodapos.weebly.com/uploads/1/3/1/6/131636969/9047a.pdfIn PDF document text
- https://fubalaxusagipun.weebly.com/uploads/1/3/4/1/134108832/18155a8fe20012.pdfIn PDF document text
- https://bipovubukixepev.weebly.com/uploads/1/3/2/7/132740720/839d38a1.pdfIn PDF document text
- https://pofofeteb.weebly.com/uploads/1/3/2/6/132681268/kolekogaxawisolo.pdfIn PDF document text
- https://mejotowud.weebly.com/uploads/1/3/0/9/130969644/vaxures.pdfIn PDF document text
- https://pulezigo.weebly.com/uploads/1/3/4/6/134600697/jimapurovo.pdfIn PDF document text
- http://nafigunagofadab.getenjoyment.net/livre_d_alphabetisation.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/1c9965a3-c07c-4f52-a454-70db81aa8636/td_jakes_book_soar.pdfIn PDF document text
- https://s3.amazonaws.com/wiwuxot/informal_region_geography_definition.pdfIn PDF document text
- http://nuzavaxevarap.epizy.com/milady_chapter_12_basics_of_chemistry_test_answers.pdfIn PDF document text
- http://zovitox.epizy.com/journey_through_anglo_american_literature.pdfIn PDF document text
- http://rafoputoxuxu.epizy.com/feleminamepelepozuse.pdfIn PDF document text
- http://xabudavadeguvo.myartsonline.com/4963315038.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01fc0167-cd9c-4426-8adc-59e2d3dd9319/sufenoziziresexuxax.pdfIn PDF document text
- https://s3.amazonaws.com/fenatagazise/zikitet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/401e102c-4413-4bfb-b9f7-bb0330d23773/suvofilijetutesuzipikuwit.pdfIn PDF document text
- https://s3.amazonaws.com/nitizobuv/best_free_technical_drawing_app_android.pdfIn PDF document text
- http://bumurulepowele.myartsonline.com/birarokevuvoloxigilize.pdfIn PDF document text
- https://s3.amazonaws.com/tuzakifezara/msc_applied_mathematics_syllabus.pdfIn PDF document text
- https://s3.amazonaws.com/lusegokaves/english_worksheets_for_grade_5_cbse.pdfIn PDF document text
- http://kogotiru.myartsonline.com/bootea_eating_plan.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e99a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE99A | 5328 bytes |
SHA-256: 10ee1e88ebca481f5d056a3c03a259066ad2540b63467a82a914915a86670040 |
|||
font_01_sfnt_off0000fba9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBA9 | 10676 bytes |
SHA-256: d87365583e89d635e84ca8359d8fa0b57ba318958d1d6c4a6d67739971421643 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.