MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'jacksth.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into clicking on a link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/award?keyword=cedula+de+identidad+ecuador+pdf
- https://cdn.sqhk.co/redupalulaxo/jgdlhbh/zobuxaro.pdf
- http://zoguponuwuxoli.medianewsonline.com/cub_cadet_lt1050_deck_belt_keeps_coming_off.pdf
- http://spindlndou.space/damijhsba6.pdf
- https://cdn.sqhk.co/pakebisas/AidqVjg/aliexpress_super_deals.pdf
- https://cdn.sqhk.co/pixazizaze/QgdGifN/36246375221.pdf
- http://pixxel.life/624285665611649x.pdf
- https://cdn.sqhk.co/pivugituxi/a4jfkNQ/xefowimozonafifevilatetef.pdf
- http://tuvivukaroj.mygamesonline.org/75286260739.pdf
- http://zuvixomajav.22web.org/89904042936.pdf
- http://muzesumulel.getenjoyment.net/21538594233.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://rimefuvax.epizy.com/act_values_worksheet_bullseye.pdf
- https://s3.amazonaws.com/genukopapovixo/logo_quiz_ultimate_answers_level_7.pdf
- https://s3.amazonaws.com/zukogi/android_file_transfer_windows_7_free.pdf
- http://vilatelisoto.onlinewebshop.net/metal_forming_operations.pdf
- https://s3.amazonaws.com/nigimul/7923874952.pdf
- https://s3.amazonaws.com/firigugixujotov/zedetolarefojisop.pdf
- https://s3.amazonaws.com/zafirawit/avicii_wake_me_up_video_song.pdf
- http://zonafikepejese.onlinewebshop.net/dixopakixavelotameba.pdf
- http://gaxilitexu.onlinewebshop.net/votimixisixa.pdf
- http://betakudo.atwebpages.com/adenovirus_enterico.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_006_off00021ad2.bincdaa09d52eac4288e0ed827907f9c833721426625e36f017ef3f33e018bc9715 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x21AD2 | 17072 bytes |
font_00_sfnt_off0001d375.bina59be4b01827af5a6cb453748b241bb7cdb3d0d26a4fee26f2802842d770b7c4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1D375 | 4876 bytes |
font_01_sfnt_off0001e415.bin9644a092fa93b40af590e817d1006522a6ca79f9bb14d604dcbce3df1ff55236 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E415 | 18284 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.