MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL, https://smidgel.ru/pbw?utm_term=language+in+use+review+present+simple+and+present+continuous+read+two+online, is likely part of a phishing or social engineering scheme to trick the user into visiting a compromised site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9953
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://smidgel.ru/pbw?utm_term=language+in+use+review+present+simple+and+present+continuous+read+two+online
- https://cdn-cms.f-static.net/uploads/4374715/normal_60be192693893.pdf
- https://static.s123-cdn-static.com/uploads/4391634/normal_5fefbeea5587a.pdf
- https://cdn-cms.f-static.net/uploads/4492918/normal_5fd735a5f1897.pdf
- https://cdn-cms.f-static.net/uploads/4488329/normal_60502af1acb8c.pdf
- https://cdn-cms.f-static.net/uploads/4477921/normal_605beb393150c.pdf
- https://cdn-cms.f-static.net/uploads/4424953/normal_601fcbb61072f.pdf
- https://static.s123-cdn-static.com/uploads/4403951/normal_5ffe91014e4b0.pdf
- https://static.s123-cdn-static.com/uploads/4445324/normal_5fe2b5f671e13.pdf
- https://cdn-cms.f-static.net/uploads/4477626/normal_601d92eac6a7e.pdf
- https://cdn-cms.f-static.net/uploads/4446017/normal_5fd6c3168f810.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zuvuzut.pbworks.com/f/recommendation_letter_for_scholarship_download.pdf
- https://uploads.strikinglycdn.com/files/c3c09a61-1414-4d17-98a9-9020d366875f/nitamowenedafava.pdf
- https://uploads.strikinglycdn.com/files/6e186a4c-b0b0-421c-aa5d-7a67e7ada36c/60377295395.pdf
- http://nutafojijoki.pbworks.com/f/jenozi.pdf
- https://uploads.strikinglycdn.com/files/80d32110-fafc-43f4-8b07-69b57d175e3a/39287117258.pdf
- https://uploads.strikinglycdn.com/files/106de740-65cb-43e9-b1e3-2dfff7a387ef/luwafojuxowigana.pdf
- https://uploads.strikinglycdn.com/files/ed6b3fc3-a6d9-44d7-b962-38946dad5f74/mexidokutedidorajisawuvi.pdf
- https://uploads.strikinglycdn.com/files/1d1954d1-d06b-47e3-a55f-8cfb0279ac0f/cuanto_es_5.2_metros_en_milimetros.pdf
- http://xedidovetaw.pbworks.com/w/file/fetch/144412518/54740183798.pdf
- https://uploads.strikinglycdn.com/files/c3e06928-3838-480a-b1f1-1a83492663b4/the_absolutely_true_diary_of_a_part-time_indian_chapter_12_summary.pdf
- https://uploads.strikinglycdn.com/files/3a2ffe69-2f34-4952-a1f3-a3e5a1888367/letra_da_musica_nona_sinfonia_de_beethoven.pdf
- https://uploads.strikinglycdn.com/files/59982f3f-a2b5-4c58-a200-4deecb49289e/how_to_overcome_poor_listening_skills.pdf
- http://puzavofan.pbworks.com/w/file/fetch/144593106/tif_guidelines_thalassemia_tdt.pdf
- https://uploads.strikinglycdn.com/files/1a06b710-1c7a-4717-97fc-9eb3ea3f33ef/razonexaja.pdf
- https://uploads.strikinglycdn.com/files/09157fe5-27fc-4fa7-8e45-1fa8f82710d3/wuwaputedazewu.pdf
- https://uploads.strikinglycdn.com/files/479625e8-62d8-434e-aab3-3f7e48ef0035/mn_drivers_license_test_plymouth.pdf
- https://uploads.strikinglycdn.com/files/a967c697-fbeb-41b0-9b85-d5f625711cdf/how_to_draw_eyes_step_by_step_easy.pdf
- https://uploads.strikinglycdn.com/files/4cf6328e-35f1-4bef-9d76-c238f99a973b/optiplex_760_specs_cnet.pdf
- https://uploads.strikinglycdn.com/files/39f282d3-348b-4c99-9f2a-e1488b9fb1a2/nozugavizunijivurelivaz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea02.bin70133062908e36ee1c0da24b0b5d61692d3725ec331fbf413dd4b95b46e73482 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA02 | 5484 bytes |
font_01_sfnt_off0000fcb0.bindc4587ba38284da379c026b2892098a666388c250a3aa7d28f7ab27224b71ceb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCB0 | 10772 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.