MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://queure.ru/pbw?utm_term=basic+electrical+engineering+book+by+sk+sahdev+pdf+download', which is likely a phishing lure. The document body, though heavily obfuscated, suggests a pretext related to downloading a technical book. No scripts were extracted, but the presence of a malicious URI in a PDF strongly suggests a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://queure.ru/pbw?utm_term=basic+electrical+engineering+book+by+sk+sahdev+pdf+download PDF link annotation
- https://static.s123-cdn-static.com/uploads/4443588/normal_5fde1388c83ec.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4457590/normal_5ffe7e4180a69.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450248/normal_6038fc3024b19.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420438/normal_6027e27e0e0af.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/9a93ab9a-11bf-44ad-93ef-007579bcffea/what_motivates_you_to_do_your_best_every_day.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/247ec33a-6b0b-43c4-9052-243b2e1e391c/how_to_keep_track_of_tasks_in_microsoft_teams.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/793dd558-233c-454a-b69e-c94b371f01ce/black_ice_fennec_car.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6bc0026a-d9f2-4ec4-a75d-2e7cfc901b50/92607463513.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29b8b43b-f2c5-45f9-acfe-27dd553ca25e/volunejamu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/408b65ca-9ee2-4b9c-9528-7a96bee341af/26333345644.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f29bbc0a-2d3d-4aac-902c-e15d753aad97/tuvusiwotireposufijisuzog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1418db58-3642-404e-91f4-e759878ead94/33631595937.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/298d12a8-49d2-43c6-bccc-b42c188546cd/physics_for_scientists_and_engineers_4th_edition_solutions_knight.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af7c68e3-8453-4286-8398-f1d01df145f1/the_b_word_in_arabic.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d27a156-0e31-4db3-ad4a-f83f74714ec8/64066317930.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e9cec04-4057-4ef7-8e7d-986a70ed2445/how_much_is_a_john_deere_3020_worth.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6edae8b0-2653-4314-a72b-678187a5603b/firehouse_subs_tuna_salad_nutrition_facts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0161f48f-e2ff-4e63-bd77-3597e6bea3ee/how_to_draw_anime_female_head.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cea73bc4-0c23-4be9-8f0a-215a46b152e0/kererubojapiguxuluwowagon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02a18c8f-dbca-4a23-b1da-aae2d9292794/42583271436.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c5a3182-5cca-4ba1-bcc4-db3dd50127d8/kugatimuripitojimefok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/707c1e95-9eff-4ea9-a81d-5c8398854b0f/fetugovoz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28d39623-e2dc-48b8-92c6-b58ec5146788/what_does_blinking_yellow_light_mean_on_firestick_remote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5ac7b6e8-903e-442e-809d-e76ed9951ca4/7982130074.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7c6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7C6 | 5924 bytes |
SHA-256: d743603e7cc9bd44a69638cb452215ba484bfbd835c947bbd18db25b021682cc |
|||
font_01_sfnt_off0000fc04.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC04 | 11192 bytes |
SHA-256: c3edb02477bf37f9c6c73545796cc78f735dcc5e763eacc6b7bb9da8f2b02719 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.