MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF document exhibits characteristics of a callback phishing lure, instructing the user to call a phone number for a fabricated issue. Additionally, it contains instructions for handling a password-protected archive, a common tactic to bypass gateway security. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific payload.
Machine Learning
- Nyx PDF Classifier clean score 0.0001
Heuristics 3
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.cs.ucsb.edu/~seclab/projects/torpig/index.html In PDF document text
- http://www.iec.chIn PDF document text
Extracted artifacts 13
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_018_off00373963.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x373963 | 39644 bytes |
SHA-256: 02ca48636d7539cefbc4a6054fd08fe2ad922154b5681f424ec537bf028c0714 |
|||
icc_00_off0000054b.icc |
pdf-icc-profile | PDF ICC profile at offset 0x54B | 3144 bytes |
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
|||
icc_01_off0000101f.icc |
pdf-icc-profile | PDF ICC profile at offset 0x101F | 1328 bytes |
SHA-256: eda03c8910c87b8a3e3c1ffbc35d223da8ae1d0dcfbad0c153c4eefbff436723 |
|||
font_00_sfnt_off0037ac56.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37AC56 | 12688 bytes |
SHA-256: 23d0b9a44a53b4d35a1c5d663b9cfc002f087e30553b2fc3a003aac2230a29a8 |
|||
font_01_sfnt_off0037d48b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37D48B | 4776 bytes |
SHA-256: caf9e5fc7f7022937e74879932cb6e8b1504990c681e25673e9c519046b0a9ab |
|||
font_02_sfnt_off0037e3fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37E3FB | 5064 bytes |
SHA-256: c189ae862e2230b74d37b3e8c8dc4c45233995e6dc151fbcec6b378d456dcfa0 |
|||
font_03_sfnt_off0037f1fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37F1FC | 4044 bytes |
SHA-256: 791d32ed5036fba05ebba6b739670c76f93942506aa3eaed031f00026ad3b545 |
|||
font_04_sfnt_off0037ff9a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37FF9A | 40728 bytes |
SHA-256: 152edf8beccd008db1f273efae77e811e676757f65c3b3f0b1dc87f2e9c3f094 |
|||
font_05_sfnt_off00386e84.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x386E84 | 15748 bytes |
SHA-256: ab7572c8b259c52d5dc7788c713be06081fb3a8600d280d8ed024474fd008104 |
|||
font_06_sfnt_off00389f40.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x389F40 | 40632 bytes |
SHA-256: 25cb4fa7131622ab24371e45002c736e7b570003839c79be21fefec75a40f98d |
|||
font_07_sfnt_off003910a8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3910A8 | 10004 bytes |
SHA-256: 0c14f3139d4c788721b2a3f85188bafdfbe52b03c89a3e65914a5be858facda5 |
|||
font_08_sfnt_off00392732.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x392732 | 7140 bytes |
SHA-256: 9a8505e4f7f8467debb57b986414535e1ca9c3e26c5b77349b850a4dcb8e4972 |
|||
font_09_sfnt_off00393ae5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x393AE5 | 20512 bytes |
SHA-256: 5eb26faa61052b3548caa5b3b7038013efc2baeb962dd70520a3ae227e01ca25 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.