MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious URL, which is likely intended to lead the user to download a secondary payload. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external URLs and the malware detection strongly suggest a phishing or credential harvesting attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9965
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wb?keyword=steel%20column%20design%20calculations%20pdf PDF link annotation
- https://wesatelifap.weebly.com/uploads/1/3/1/8/131871597/jimusezovafavad.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451363/normal_60262337b7aa7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478438/normal_601ad2f59e9af.pdfIn PDF document text
- https://zafuzumu.weebly.com/uploads/1/3/4/6/134674349/b6d1520821ab.pdfIn PDF document text
- https://bubamixidik.weebly.com/uploads/1/3/4/6/134657394/5982249.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459787/normal_606caf4bc135b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423189/normal_6058f0d1e9a37.pdfIn PDF document text
- https://kakituku.weebly.com/uploads/1/3/4/5/134589995/gupegin_bidogolitosizu_zamilusisi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412588/normal_6035309cdeba4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4383792/normal_5ff9f599c6377.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461245/normal_606d67f85c576.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/90cdec15-7cc2-40a8-a1e2-f67afc5f51de/zajedotikawewamok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a49c7f3b-f7f6-4970-a8cf-5b76f6924696/22533623794.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d52b237a-faaa-4459-bae9-e4e2af6810df/nemalafakepuxedixedota.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d84f336-7519-4912-bd09-91cd27d81b65/sub_zero_fridge_service_toronto.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da4a633c-6a02-458b-91c6-fe34abf4fddc/14296645431.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/efa4ba0d-cc21-4a8b-9140-6da9c2ee7a1d/janito.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6764cac-e139-4bb3-bbc2-454a155d93f2/mitsubishi_pajero_io_service_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7471021d-8810-4569-a339-f35aa5c6a20e/80312908627.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9497e8b-fd7c-497d-bea4-da67b1db7697/gorupobiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53479af3-6fba-47a1-97ef-97322e5b3635/sonineliwitenudenitawos.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002317d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2317D | 2148 bytes |
SHA-256: e56eb5fc9e52921e3df016166c15a7fa8e987deef85fc513b801d20b53f665f3 |
|||
font_01_sfnt_off00023b49.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x23B49 | 5364 bytes |
SHA-256: ed1442426d53634783cc9d1aace44c4be2faad978bf0e47ff6f29d27f0fa1ba9 |
|||
font_02_sfnt_off00024d6c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x24D6C | 13168 bytes |
SHA-256: 9bf377b41adb25c1b0190e477913ebe505aa91f9d4d012c295bffa848f68f515 |
|||
font_03_sfnt_off00027a42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x27A42 | 16996 bytes |
SHA-256: a3b512e1abaebeab995fbc7b0f05d10725988795f9a1f8298865dd840d614cb3 |
|||
font_04_sfnt_off0002926e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2926E | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.