MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of numerous embedded URLs, many of which point to PDF files hosted on potentially compromised websites, suggests a phishing or credential harvesting campaign. The document body, though heavily obfuscated, contains metadata related to PDF generation, further supporting its role as a lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.eflox.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606c69a7e61b7---takuwivivafoze.pdf
- https://boumqueur-edition.com/upload/fckeditor/file/lesuzinuxamotivagipuw.pdf
- http://hnkingdee.cn/Files/file/2021526181937.pdf
- https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607b039ba55f0---ligad.pdf
- http://al-bandak.com/userfiles/file/zuvobupumuroji.pdf
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/160832e0bd09ea---65910915017.pdf
- https://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/7imfit3j7ui2341g3djtssn4a0/tomazoxurerusez.pdf
- http://interel-rus.ru/test/sites/default/files/file/xasexizodesisugowilubo.pdf
- http://mognational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160894cd7d3c37---75596304995.pdf
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab551754cce---97140979169.pdf
- https://miamivanservice.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607a4888c27de---59428181828.pdf
- https://singaporeroadshow.com/wp-content/plugins/super-forms/uploads/php/files/1a83255559d39a1cf2376588e9dc2375/22875000050.pdf
- http://maynenkhiinverter.com/media/ftp/file/tobebubekepora.pdf
- http://albatrossmrn.com/konadnew/userfiles/file/85839828950.pdf
- https://chefinhogourmet.com/wp-content/plugins/super-forms/uploads/php/files/b6c2e98fe0cb6f4315bfe25954a0c4e4/1490358287.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=determining+volume+of+joined+rectangular+prisms+worksheet
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cf7b.bin66fa99a840727f0612f9aa46d808811b34f54f274cdcc2e7a77fca6dfaa1a68c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCF7B | 5860 bytes |
font_01_sfnt_off0000e363.bin9cbafd694a88978aa5196c1b65a1adbf830e7d85ccda76e2846d7c5803e4c984 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE363 | 10588 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.