MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an external URI pointing to 'https://vilenefex.ru/strik?utm_term=how+to+transpose+m-audio+keystation+49e', suggesting a phishing or social engineering lure. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=how+to+transpose+m-audio+keystation+49e
- http://vemolizikogevu.22web.org/52158742662.pdf
- https://cdn.sqhk.co/gajamomol/f2hajeT/tamil_memes_video_templates.pdf
- http://myyshooop227.site/the_opposite_of_loneliness_wordn0wi9.pdf
- http://tokio-2020.fun/wosomop93f81.pdf
- https://cdn.sqhk.co/duvetezoje/gdifalP/21939999175.pdf
- http://classkaod.ru/cast_away_movie_openloadc6ktq.pdf
- https://cdn.sqhk.co/molavagew/3sC3ha5/43656573756.pdf
- http://ributufukepun.66ghz.com/60292028180.pdf
- http://gifinekinurubuk.iblogger.org/dowry_act.pdf
- http://fragcups.com/64289008993prv0c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://ravezipago.epizy.com/fogesotoponazef.pdf
- http://kogasalilim.epizy.com/autocad_architecture_tutorial_for_beginners.pdf
- https://s3.amazonaws.com/sepovutapakogaf/endlessly_muse_sheet_music.pdf
- https://uploads.strikinglycdn.com/files/5c0e9d2c-de5a-4b4e-8d32-13cd523aa008/157684565.pdf
- https://s3.amazonaws.com/dugibabafod/99230547791.pdf
- http://fezexebu.rf.gd/bucharest_map.pdf
- https://uploads.strikinglycdn.com/files/211e25df-e617-4b62-a9cb-ae4d54d8296d/how_to_test_a_thermo_sensor.pdf
- https://uploads.strikinglycdn.com/files/62abbd7d-58fe-4aff-8e08-769bbfc63110/what_does_objection_your_honor_mean.pdf
- http://tokoxabegike.rf.gd/uefa_champions_league_2020_20_calendar.pdf
- http://bofidimasep.rf.gd/30640569595.pdf
- https://uploads.strikinglycdn.com/files/69132444-6821-4f6b-a549-3aa971c690b8/qu_medios_de_comunicacin_oral_conoces.pdf
- https://s3.amazonaws.com/tixeligufokup/xojidalasalasaw.pdf
- http://pivujumurabaf.epizy.com/calendario_escolar_2020_para_imprimir.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ded2.bin468852b8315116d9e97e5a8656b70d2ffa2923052e71befe4c41c16324ac2de9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDED2 | 5568 bytes |
font_01_sfnt_off0000f1d8.binc39cfac8eb6591d210fa2aa653b4f7a9920b8a7f54348685b781b24d2be86402 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1D8 | 10948 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.