MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, 'vilenefex.ru', which is likely used to host a phishing page or deliver a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'mtnl landline surrender letter format in marathi', indicating a targeted social engineering attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9960
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=mtnl+landline+surrender+letter+format+in+marathi PDF link annotation
- http://sebokuxaxugu.iblogger.org/75035313947.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/002fac56-8661-4651-9899-c40372118da7/generac_gp3300_muffler.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6659c9d3-045e-482b-b215-0fe04fccdc48/what_are_the_poetic_devices_in_the_road_not_taken.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f4f52d3-bb34-461c-8577-4d8b8ff1159a/35454405310.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4152330b-fd2c-41b8-b250-28f0c19fa43b/95675413607.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1be8780f-781e-477e-83f8-909184997a8d/focusrite_scarlett_2i2_3rd_gen_usb_audio_interface_with_pro_tools_first.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18ca6bd3-862a-4d27-ac40-69b43b7155aa/how_do_i_reset_my_pdp_controller.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3187d33c-a5c0-42fa-b616-f4287ec317c7/sabesuluzikikezanar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/78c4d836-4f65-4942-9be3-3bd3232a775b/97814753329.pdfIn PDF document text
- http://joruvone.epizy.com/apostila_auditor_fiscal_municipal_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/573a153d-f935-4a6a-b604-3e01e779ff1d/defiant_solar_motion_security_light_2100_lumens.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e3b50681-8c86-4c05-85f9-e044eba35eaf/panebedafirajuvodovofime.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c6eb3fe-acc3-4aee-8c2d-7d17361d2a9b/what_is_the_meaning_of_advent_candle_colors.pdfIn PDF document text
- https://s3.amazonaws.com/jepavilutabilel/rmit_citation_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a84b88b0-faf6-4f60-8d99-5cdc7c78d338/data_structures_and_algorithms_in_java_6th_edition_source_code.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a7f8226-d9cd-447a-8b1f-fe1a98033146/que_formas_de_expresion_oral_existen_wikipedia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/487cbe3c-007a-4825-ad46-aa2191f3fa6f/setup_my_harmony_350_remote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30c40206-e463-4007-8b35-a2301089f03f/what_does_the_word_alpha_male_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d52e692-b1de-4d85-802d-2e9baff32470/python_iterate_through_string_in_chunks.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f97dfe3-5a27-4369-bfcb-7315b074d0df/3737204496.pdfIn PDF document text
- https://s3.amazonaws.com/tixeligufokup/clair_de_lune_sheet_music_easy.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df2bd1cb-354a-4d41-9c14-e9f6c6192d20/chicken_soup_for_the_soul_stories_of_hope.pdfIn PDF document text
- http://sovotovagito.epizy.com/maths_formulas_upto_class_12.pdfIn PDF document text
- https://s3.amazonaws.com/loxopudizus/salesman_comedian_2018.pdfIn PDF document text
- http://tatepazutapoz.rf.gd/91449679478.pdfIn PDF document text
- http://pewulalabes.epizy.com/the_rules_of_basketball.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef7c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF7C | 5152 bytes |
SHA-256: 7779f32eb5b2f7e45e32c31320f6de9cb4c4367073be8964b10564d56763c965 |
|||
font_01_sfnt_off000100e0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100E0 | 10604 bytes |
SHA-256: eb864b7baf933fed2ed7f81fd78cc0f8431f1b29dc98ec7d0c5110faed98205d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.