MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document flagged by ClamAV as a phishing trojan. Heuristics indicate a payment redirection lure, suggesting the document aims to trick users into believing they are interacting with a financial service. The embedded URL, https://vilenefex.ru/award?keyword=hdfc+fd+rates+2020+pdf, likely leads to a malicious site designed for credential harvesting or further malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LUREDocument describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/award?keyword=hdfc+fd+rates+2020+pdf
- https://static.s123-cdn-static.com/uploads/4485578/normal_5fc582a0dfc2a.pdf
- https://cdn-cms.f-static.net/uploads/4407316/normal_602c0a4742310.pdf
- https://cdn.sqhk.co/ferorigife/ia9hh4l/buddy_toss_mod_apk_revdl.pdf
- http://xikimubixod.22web.org/79813832547.pdf
- https://cdn.sqhk.co/tategupet/kKvgegh/56111480053.pdf
- https://cdn.sqhk.co/xibidodoko/jhhbVki/90773810648.pdf
- https://cdn.sqhk.co/genonitag/djiqih2/gq_shirt_collar_guide.pdf
- https://cdn-cms.f-static.net/uploads/4413475/normal_60390ea5b094f.pdf
- https://static.s123-cdn-static.com/uploads/4477651/normal_5ff8774654ad2.pdf
- https://cdn-cms.f-static.net/uploads/4369307/normal_604cc373c357b.pdf
- https://cdn.sqhk.co/tivanosox/bgiYCzU/98588587125.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/c77ae8fd-6579-4240-9a76-01b6329994a7/widozazitekoso.pdf
- https://s3.amazonaws.com/fajeloninesitel/80141509981.pdf
- https://s3.amazonaws.com/wuwabobujasivor/44021452732.pdf
- http://gorevifero.epizy.com/soundtrack_aladdin_a_whole_new_world.pdf
- https://uploads.strikinglycdn.com/files/dcbbb97a-7e39-4a6f-b7c5-3ab396e00885/rixetuwanibig.pdf
- https://uploads.strikinglycdn.com/files/593710ea-19c5-489d-b306-9dd392cab762/how_to_change_battery_bose_remote.pdf
- https://s3.amazonaws.com/bidivo/minuet_in_g_bach_violin_sheet_music.pdf
- https://uploads.strikinglycdn.com/files/c7bde207-9fe8-4565-b52e-f1aa180c1809/word_search_books_in_bulk.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f65e.bin4b85de513e374f9f842e625d602c00de54b8a2d483391d6018236f8e11c6ea5d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF65E | 5352 bytes |
font_01_sfnt_off0001089b.bin0b9e95208141a2eb999b3005c3980caa624f5be4b5ff600f087c489327a776d3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1089B | 10744 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.