MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to a URL that appears to be a lure for 'adjectives worksheet pdf grade 1' suggests a phishing or social engineering attack. While no scripts were explicitly extracted, the PDF structure and embedded URLs are strong indicators of malicious activity, likely involving the redirection of users to a compromised site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=adjectives+worksheet+pdf+grade+1
- http://zawugudumi.getenjoyment.net/has_the_crown_been_approved_by_the_royal_family.pdf
- https://kusopexel.weebly.com/uploads/1/3/4/5/134526262/685879.pdf
- http://bovewitavivebu.getenjoyment.net/what_is_a_peter_principle.pdf
- https://cdn-cms.f-static.net/uploads/4415518/normal_601aff8136c0f.pdf
- https://wudowured.weebly.com/uploads/1/3/0/8/130873715/namazokema_wisov_mowezikox_porijofok.pdf
- http://sevezor.scienceontheweb.net/xawedutafel.pdf
- https://koxabiwepa.weebly.com/uploads/1/3/4/3/134309970/633bc9d.pdf
- https://static.s123-cdn-static.com/uploads/4471253/normal_5fe5a8a32afd7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/divexikav/fobosad.pdf
- https://s3.amazonaws.com/gimisorixosu/dosti_shayari_video_whatsapp_status.pdf
- http://xedaxabefax.rf.gd/sozewilofujopu.pdf
- http://jezanijumoz.epizy.com/jeu_de_cartes_a_3_facile.pdf
- https://s3.amazonaws.com/fejakixoweka/vezovozudivawasiba.pdf
- http://poramukuwulaji.epizy.com/xirowexifujew.pdf
- http://womidelere.myartsonline.com/76327697812.pdf
- https://bf6af823-cb0d-4ee8-9d5b-4f0b1de5ed24.filesusr.com/ugd/9eb187_b7e6bdf126f7418cb2c727006f2b65c8.pdf?index=true
- http://zinizebaki.epizy.com/adventure_island_map.pdf
- http://fufifaramulemi.rf.gd/goroke.pdf
- https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_dbd87097e9db48298b31919bb9a5d8ba.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cb7c.bin16fc12057720cd3910a92565912cd54b64dcd0d1899fc055f294f45f174fddf3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCB7C | 5720 bytes |
font_01_sfnt_off0000df19.bin7b029b9dd41eb15c30d6023ece20825ee0915c398bee7cfa9879d1a639dbb4ce |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDF19 | 10468 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.