MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a search query, aiming to trick the user into clicking the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=what+does+flo+mean+on+sundance+spa
- https://karopudalel.weebly.com/uploads/1/3/4/8/134881347/zineli_wovukedokomet.pdf
- https://kivobuduzuv.weebly.com/uploads/1/3/0/7/130739084/tuvigizetesupid_gedujofowu.pdf
- https://cdn-cms.f-static.net/uploads/4503387/normal_605a12d86262d.pdf
- http://lewizakadogera.iblogger.org/22037038583.pdf
- https://cdn-cms.f-static.net/uploads/4499958/normal_606e1ec921fef.pdf
- https://barutonujumajom.weebly.com/uploads/1/3/0/7/130739232/7977731.pdf
- https://vorexumezekadan.weebly.com/uploads/1/3/0/9/130969740/2c15d5d396.pdf
- http://terasivox.22web.org/kabbalah_for_beginners.pdf
- https://cdn-cms.f-static.net/uploads/4392463/normal_601c03b1454d6.pdf
- http://bivemipizejon.22web.org/11372245313.pdf
- https://cdn-cms.f-static.net/uploads/4403429/normal_604475068f63e.pdf
- https://cdn-cms.f-static.net/uploads/4403531/normal_6057b6ed854c4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://venakato.epizy.com/64968754588.pdf
- http://bifelizebov.rf.gd/62288624998.pdf
- http://lokimutopilar.epizy.com/bartholinite_et_grossesse.pdf
- https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_16778aa8cb92496fb762caed2eb550f2.pdf?index=true
- http://rozasazi.epizy.com/87282314993.pdf
- http://birifamabaxum.rf.gd/how_much_does_a_honda_rebel_300_weight.pdf
- https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_19cc74c9cf564e61b0af859246ec6fdb.pdf?index=true
- http://nanoxamovafosox.epizy.com/futura_pt_bold_font.pdf
- http://xodojes.epizy.com/kadoxanosawewopexowo.pdf
- https://189c2d36-84ff-4b81-9465-96c33c1d3b91.filesusr.com/ugd/35ddae_51cc1756f08546b79192a3fa86567b07.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f16f.binf4fe18860bd42624046d87bd881970906b92faf72216ff4c13c25095801cfeb5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF16F | 5312 bytes |
font_01_sfnt_off00010371.bin6f25df58f40fb63467ed47537b3975547b9f406543f53d0362117502cdd588bf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10371 | 11236 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.