MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by ML classifiers as malicious and exhibiting characteristics of an advance-fee scam. It contains an embedded URI pointing to a suspicious domain, likely intended to lead the user to a phishing or malware download site. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick the user into visiting a malicious external resource.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 4
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/award?keyword=live+life+golden+we+were+golden
- http://itwomen.space/how_to_pair_2_doss_speakers3ab5y.pdf
- http://retys.space/what_is_newtons_laws_of_universal_gravitation0ujvs.pdf
- https://cdn.sqhk.co/ledazukogim/izjbgh6/black_widow_movie_release_date_nz.pdf
- https://cdn.sqhk.co/parikozug/gegfM5l/thomas_runyan_md_brunswick_ga.pdf
- http://busevabafumoje.iblogger.org/venice_vaporetto_route_map.pdf
- http://theraisins.pro/troy_bilt_pony_drive_belt_sizef0zc6.pdf
- http://gta-msk.ru/pupuzeruxibbhapo.pdf
- http://lessonsonline.site/video_downloadhelper_firefox_youtubegri3u.pdf
- http://idealica-italiauficiale.website/reported_speech_imperative_sentences_worksheetss79ez.pdf
- http://pihodze.com/kikitefarurovidony1eem.pdf
- http://thepropheticapp.com/surovekurotetulna9sd.pdf
- http://zatoboyvibor.fun/nosozezu8yb3.pdf
- http://kadafujefofamu.22web.org/what_is_subject_of_quran.pdf
- https://cdn.sqhk.co/jazumagefo/ihgiMjf/ducks_unlimited_banquet_2019.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://gudinomid.rf.gd/tumidisoragaxejivatujuwor.pdf
- https://s3.amazonaws.com/feborobegibew/19339258096.pdf
- http://pulupalu.epizy.com/54078268531.pdf
- http://gepuwuvezu.epizy.com/answer_key_2019_ctet_paper_2.pdf
- http://bulujulu.rf.gd/27913577615.pdf
- https://s3.amazonaws.com/rizezobabub/case_simulator_2_pc_free.pdf
- http://towixamum.epizy.com/46078568690.pdf
- http://xamufalifab.epizy.com/diferiwasupuvax.pdf
- https://s3.amazonaws.com/jagux/jin_bts_tonight_lagu.pdf
- https://s3.amazonaws.com/xunilukegez/react_axios_binary_file.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb5a.binddf6e7b009245a182a463b4816c4504a0118f7d556e00dff005d5ce466392e9e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB5A | 4780 bytes |
font_01_sfnt_off00010bc8.bind6299b9402a8ddc19f4eff3165269cbac1d80d96603239565ef10b1c3a641fbd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BC8 | 10472 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.