MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URI pointing to 'https://xezojetit.ru/award?keyword=backstepping+control+pdf', suggesting a phishing or malware delivery attempt. The document body, though heavily obfuscated, contains metadata related to PDF creation and a keyword that might be used as a lure. No scripts were extracted, but the presence of external URLs and the ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4988
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/award?keyword=backstepping+control+pdf PDF link annotation
- https://static.s123-cdn-static.com/uploads/4388596/normal_5ff16abd596b0.pdfIn PDF document text
- http://cashtanks.fun/6342345735w0q7v.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382790/normal_5ff5acec7a07b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470699/normal_5ffdd2e97b0db.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4409403/normal_5fdcbe46e65a9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409619/normal_602a251c1dca3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485446/normal_6044d944e7009.pdfIn PDF document text
- http://kernig.pro/little_red_riding_hood_name_characterskplyb.pdfIn PDF document text
- http://paksorond.xyz/moto_g6_plus_pattern_unlockrpqn3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479917/normal_5fdf3a46c9995.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4450721/normal_5ff445613ddb9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478928/normal_604972cd7a2ed.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446170/normal_5fd087349276f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489853/normal_5fe42657daf3c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4475588/normal_600c5f98205a2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477638/normal_6026390f3682a.pdfIn PDF document text
- http://persequen.com/jejovoruwaz99mn.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4408485/normal_6001ca9dd906f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4474220/normal_5fcfeb22829ce.pdfIn PDF document text
- http://dhl-order.info/26782994631k9rt5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455399/normal_5fd8efad56032.pdfIn PDF document text
- http://ryursew.space/single_source_justification_letter_templateosbni.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460982/normal_602ca9c8cc11b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446645/normal_5fcbde71e07c0.pdfIn PDF document text
- http://kozlo.space/bolingbroke_academy_sixth_formm53yi.pdfIn PDF document text
- http://front-glass.website/76199429882czywc.pdfIn PDF document text
- http://meetcabinets.xyz/what_is_the_coldest_temperature_in_jacksonville_floridanx4v9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001228f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1228F | 5436 bytes |
SHA-256: d572a26824764a881cdea5687ca8d7fe12bce21a4bf1a4fdc581ef35960a6438 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.