MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a significant number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary URL, 'https://zajinet.ru/strik?utm_term=self+defeating+behaviors+worksheets+pdf', suggests a phishing or malicious redirection attempt. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', reinforcing its malicious nature. No scripts were extracted, but the extensive link farm indicates a likely attempt to direct users to malicious websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=self+defeating+behaviors+worksheets+pdf
- https://kugakisan.weebly.com/uploads/1/3/4/3/134390280/14472.pdf
- https://cdn-cms.f-static.net/uploads/4372358/normal_601fd806d7966.pdf
- https://jasunibimagimuf.weebly.com/uploads/1/3/4/7/134733129/71b0a3e4cdd7.pdf
- https://wutuzorul.weebly.com/uploads/1/3/5/9/135963099/fdb026e1.pdf
- https://cdn-cms.f-static.net/uploads/4489247/normal_5fd7873e27bfb.pdf
- https://static.s123-cdn-static.com/uploads/4499635/normal_60059afce1ef1.pdf
- https://static.s123-cdn-static.com/uploads/4471479/normal_5ffdd0f27b71d.pdf
- https://nogapixefakul.weebly.com/uploads/1/3/4/5/134590999/konivuredazevuxula.pdf
- https://moremutinujiti.weebly.com/uploads/1/3/4/8/134865562/jijewe.pdf
- https://cdn-cms.f-static.net/uploads/4500669/normal_60371980222b3.pdf
- https://static.s123-cdn-static.com/uploads/4463279/normal_5ffc165d0179a.pdf
- https://cdn-cms.f-static.net/uploads/4448995/normal_604e2d4a82ee8.pdf
- https://cdn-cms.f-static.net/uploads/4384308/normal_603b4dd049cc1.pdf
- https://zagefejov.weebly.com/uploads/1/3/2/7/132710748/noketepanek.pdf
- https://jubabanijawema.weebly.com/uploads/1/3/1/0/131070146/252855affcd5f.pdf
- https://funiduned.weebly.com/uploads/1/3/4/7/134773133/sapemixepuv-sososebagawa-muzepa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/71cd8711-706e-409a-88dd-b955c15fe06a/the_lorax_book.pdf
- https://uploads.strikinglycdn.com/files/ceb9d5ed-7ed0-455a-a635-a206bc0f9481/18065912523.pdf
- https://uploads.strikinglycdn.com/files/77e958b4-1b20-49ff-ac27-de30ddce3e08/movimiento_rectilineo_uniformemente_acelerado_ejemplos_en_la_vida_cotidiana.pdf
- https://uploads.strikinglycdn.com/files/a626ed6a-6454-446a-98f3-e28d37e0f33d/a_street_cat_named_bob_age_rating_uk.pdf
- https://uploads.strikinglycdn.com/files/e060a432-30d5-411b-a9a5-e0d60de146bf/55601232323.pdf
- https://uploads.strikinglycdn.com/files/b679531f-d0b1-4ead-b5e6-2f7de23163c8/ldc_2017_previous_question_paper.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000106a3.bin171f0b9d1844710b2fa7126279d338c0d79c0f07eb04caecb3c2874ac79398b8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106A3 | 5760 bytes |
font_01_sfnt_off00011a4d.bina64fa476f1ba0ebdd4c8f149658a6a672abc0ddbb53cb875fe6169e268ef3d31 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A4D | 11000 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.