MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for a phishing or malware distribution attempt. No scripts were extracted, but the presence of the external URI and the ML/ClamAV detections strongly indicate a phishing or credential harvesting attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9979
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/award?keyword=burda+shareef+pdf
- http://flash-sar.online/62496290992vw4bt.pdf
- http://myluckybet.xyz/is_it_worth_buying_a_coffee_grinder8uot4.pdf
- http://montana-media.com/google_play_books_apk_freeoqtfy.pdf
- http://perulupom.22web.org/boririkobexabaniduw.pdf
- http://cloudplay.xyz/39624485270gp3wk.pdf
- http://detonic-buy.website/bassinet_fitted_sheet_australiadt6t8.pdf
- http://pafowitowa.medianewsonline.com/mortgage_amortization_formula.pdf
- http://comforfemj.fun/what_state_has_the_highest_median_income673oz.pdf
- http://byseles.xyz/sony_a230_untuk_videosmrv2.pdf
- http://sputnews.com/whats_the_difference_between_analog_and_digital_channelssna0b.pdf
- http://lanasobewusek.22web.org/cape_hatteras_fishing_report_surf.pdf
- http://timelessdecorum.com/chupana_bhi_nahi_aata_ringtone_freey2wuk.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://ligiwekuxote.myartsonline.com/ipod_classic_5th_generation_30gb_specs.pdf
- http://kesofater.rf.gd/77795938066.pdf
- http://zagofij.onlinewebshop.net/bhagavata_purana_sanskrit.pdf
- http://lavodusepigixu.rf.gd/borilegorewulejazeso.pdf
- https://s3.amazonaws.com/fonazuzixagizir/vukusibojotu.pdf
- http://fedetikapore.epizy.com/affairscloud_current_affairs_october_2020.pdf
- http://girofili.myartsonline.com/fire_and_ice_poem_interpretation.pdf
- https://s3.amazonaws.com/davolazupivowi/brother_birthday_cake_images.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off00032c2a.bin2692dd8dfcedc16ef96e42f33e7f13ff1631ee625d08438217ed8859a0be4dde |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x32C2A | 35244 bytes |
font_00_sfnt_off0002f217.bine695d2a99991c376a2cd5122970a17b9725a60ee93c85c01c36ec1466b84be4e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2F217 | 5144 bytes |
font_01_sfnt_off00030397.binb8eb9b6451c1c50c018a7f987a9e509c6cf7b59cafd6e922e1e48ccb63360557 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x30397 | 12676 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.