MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to 'pelibifir.ru', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to a 'manual treadmill'. No scripts were extracted, but the PDF structure itself likely exploits a vulnerability or uses embedded JavaScript to redirect the user.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/wix?keyword=exerpeutic+manual+treadmill
- https://cdn-cms.f-static.net/uploads/4414869/normal_604d3fcf523bd.pdf
- https://cdn.sqhk.co/juzivadareka/m5ubCgg/79376037160.pdf
- https://static.s123-cdn-static.com/uploads/4466408/normal_5ffb5a885c6ea.pdf
- https://cdn.sqhk.co/gasubapo/wKAN6hd/mivubodelaxozateraw.pdf
- https://cdn-cms.f-static.net/uploads/4426263/normal_6057a7b4b7d52.pdf
- https://cdn.sqhk.co/mareduviger/w7djcnA/bangla_baul_gaan_hd.pdf
- https://cdn.sqhk.co/kinanunir/flMpUhg/surah_e_shams_benefits.pdf
- https://cdn.sqhk.co/weruvewo/jcbFhhT/rtc_bus_mobile_app.pdf
- https://cdn-cms.f-static.net/uploads/4423195/normal_5fd789880659b.pdf
- https://cdn-cms.f-static.net/uploads/4471481/normal_605d8a5eadfd3.pdf
- https://cdn.sqhk.co/nizekidido/jc6Jhf2/jezajegofopemema.pdf
- https://cdn.sqhk.co/xegunorasu/jahcjcl/kogifowizobifovubujizut.pdf
- https://cdn.sqhk.co/wifopuzuxiba/ehfRDEO/condado_puerto_rico_restaurants.pdf
- https://cdn-cms.f-static.net/uploads/4383918/normal_5fd318a870de5.pdf
- https://cdn.sqhk.co/xajimujigaju/h49Riac/wrestling_revolution_3d_2020_apk_download.pdf
- https://static.s123-cdn-static.com/uploads/4419192/normal_5fdf079300fbf.pdf
- https://cdn.sqhk.co/jojipimuve/iaiiDvb/cannot_remove_screen_lock_pin_on_android.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a85f99fa-4fc6-4d2f-aad1-8210e9ad5a6f/9th_grade_poetry_terms.pdf
- https://uploads.strikinglycdn.com/files/05d9a172-9972-4110-8f1c-2dcf096f889e/highway_capacity_manual_2016.pdf
- https://uploads.strikinglycdn.com/files/5a54e057-55f1-4a8a-8cb1-7ff20210af40/giratosiwutowirota.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e649.bin9b4f0b8ca36954b28056466d94259be4ee590feb0977a349d73a217801072d08 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE649 | 5068 bytes |
font_01_sfnt_off0000f773.bin0b8c7bdbb6650f1eb5728d6b874d6879f037e29c6951ad46991e1957d14faf97 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF773 | 11088 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.