MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9943
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=pdf+to+word+ocr+converter+free+download+full+version PDF link annotation
- https://cdn-cms.f-static.net/uploads/4417543/normal_601f6518d8a8d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427793/normal_5fdacbd8cc4df.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372074/normal_600dc02d6d862.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4478951/normal_5ff2803f9e762.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389576/normal_5fd393fadbcec.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480399/normal_6059616906efa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378383/normal_5feba8c9d1e3a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426087/normal_6052c10f4d39e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415051/normal_606087c3918aa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421061/normal_6048860f80796.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409243/normal_602cacde4d836.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381105/normal_603426fb8d52a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413375/normal_60504c4d22910.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495034/normal_5fd92e152e07c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387589/normal_6006bbe8debd3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4480588/normal_5ff2b7853f13a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492278/normal_601ae037a83d2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495413/normal_60561d23e3e59.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444369/normal_5fd79fd424c0a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449395/normal_6001db7203971.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/5a4dc872-f832-47dc-af9b-c8981906c29a/vizio_m55-c2_stand_screws_size.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b63e9b14-802f-4e8d-8fbb-4d01b33c17f3/jumij.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e0bbfc99-0f53-400e-ac8f-1b9f8aa46ffe/1725943221.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3aeebde-5fe8-4367-b175-54b1131ff089/python_add_basic_auth_header.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72c3b0a8-db9d-46ed-b19d-6fe9cbc9d55e/tissot_t_touch_classic_price_malaysia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86f00017-0ae2-4e31-b490-315b6986cdbf/nakomavi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e44e69d2-e57b-4a61-9e80-2da5beb3871b/voxakurojuvevupowujabo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad62b86c-08c7-4329-8f30-f5c77d885b85/7054529337.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/599811be-3c1a-4bbb-a241-8258eab3bd5b/what_is_nolo_contendere_in_law.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b9c7f36-23fa-4060-84ce-26504dce7625/how_long_to_cook_spiral_sliced_ham_in_instant_pot.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000105e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105E2 | 5052 bytes |
SHA-256: 0fa62757dd5dc2d450257a2ab7b320239d1958cf670fb922f9e4dc3de61a9629 |
|||
font_01_sfnt_off0001172c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1172C | 11012 bytes |
SHA-256: a7532477bd2742036f874e6550e7133c3ffaa2ab2252f31ac41ca0e40e08181d |
|||
font_02_sfnt_off00013cf3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13CF3 | 4324 bytes |
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.