MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'xajibur.ru', which is likely part of a phishing or malware distribution scheme. The PDF structure and embedded content suggest it's intended to lure users to external, potentially malicious, websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/strik?utm_term=army+weapons+qual+tables PDF link annotation
- http://mivifukatovaga.getenjoyment.net/buffalo_bisons_schedule_2020.pdfIn PDF document text
- http://sumomubidisuwo.iblogger.org/sanolevuzomekexavu.pdfIn PDF document text
- http://xuribof.medianewsonline.com/netuwuvekumodamadiloxiz.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366660/normal_5ff69c5c7f9df.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407314/normal_5fccfd32be7d5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b9837002-52e0-4e7e-b49a-356790780a9a/how_to_use_the_weight_watchers_food_scale.pdfIn PDF document text
- https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_a94b47fe6181494f9ceac17b2f80995d.pdf?index=trueIn PDF document text
- http://wudafozejuniv.rf.gd/praia_do_carvalhal_surf_report.pdfIn PDF document text
- https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_eb515c3aace24eba8637f1555de5a569.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nisiwanolom/wacom_tablet_settings.pdfIn PDF document text
- http://vatasinunevuto.epizy.com/dujelipirabejozovilini.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/34e6d74c-52fd-49cc-aeba-e73e7176bf7f/39809022641.pdfIn PDF document text
- https://5862e4ea-63a6-4c92-af93-e06d02d1a664.filesusr.com/ugd/eaa371_2a9913fd8adb448b8792d18982b33033.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a6559abb-6395-42f0-9d34-a39e307bbe30/mivegakemebuxiwufiwixogu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d9b839c-568b-4162-b745-e172fb466d64/determine_function_from_table_of_values.pdfIn PDF document text
- http://kojuvurapamox.myartsonline.com/database_management_system_download_tutorialspoint.pdfIn PDF document text
- http://dogolapobu.rf.gd/89597908769.pdfIn PDF document text
- https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_e7ce275485d341a8afda7292833b3339.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9040178f-a479-43ce-a652-93e19269999e/jokiveboximuwugubol.pdfIn PDF document text
- https://s3.amazonaws.com/dowadotiju/kesagaxave.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001bebc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BEBC | 5416 bytes |
SHA-256: 3cd355a4308468d1db69e55d9f0c63772d20e37078f00330f8893912d1384e03 |
|||
font_01_sfnt_off0001d124.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1D124 | 11244 bytes |
SHA-256: 53303e5149b2b61d5c592a5788fb5bc1e7cd37ba5cfc85daece1b09612bc99f8 |
|||
font_02_sfnt_off0001f7be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1F7BE | 16060 bytes |
SHA-256: 5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.