MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded URLs, one of which is flagged as potentially malicious, suggesting a phishing or redirection attempt. The PDF structure and embedded content are consistent with malware designed to exploit vulnerabilities or trick users into visiting malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9680
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://feedproxy.google.com/~r/sq/ugae/~3/aauXj3bnHUA/square?utm_term=how+to+stop+unwanted+text+messages PDF link annotation
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60edcc0230d23a75506180bb/1626196994633/michael_polanyi_personal_knowledge.pdfIn PDF document text
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e831e0ba333063f17c0dc6/1625829856907/42367382024.pdfIn PDF document text
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e9387883ae0c490239e43e/1625897080907/chimeric_monoclonal_antibody_meaning.pdfIn PDF document text
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec9f87704a383bbedc231b/1626120071474/gta_5_mods_ps4_free_online.pdfIn PDF document text
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7e5107be683581ce306e3/1625810192955/1670575517.pdfIn PDF document text
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8e331787dde1a90aab609/1625875249674/29841160787.pdfIn PDF document text
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e8811176b4633dc1f48a02/1625850129241/vosanivaleteko.pdfIn PDF document text
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ed56845eed834fcc356b66/1626166916476/why_cops_touch_your_car.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cafe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCAFE | 17144 bytes |
SHA-256: bd2512c4411820047c7edecebd59dae58fc26fa7b6de1771d53e1d3d8120d232 |
|||
font_01_sfnt_off0000f7ce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7CE | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off00010fe5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FE5 | 10776 bytes |
SHA-256: b1d491f32241671bcdfd18503414e037895b6093f77c08c9fe0e35e13840e12c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.