MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, and exhibits characteristics of an advance-fee scam. The embedded URL, https://mezovuduw.ru/strik?utm_term=a+series+of+unfortunate+events+books, is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=a+series+of+unfortunate+events+books
- https://cdn.sqhk.co/zifakepavax/FjfL5wk/tovuk.pdf
- https://cdn.sqhk.co/pujixefan/qxiaR66/60432787779.pdf
- http://helpforteam.com/download_48_laws_of_power_audiobook_freea2d6e.pdf
- https://cdn.sqhk.co/tukutabu/hfjdGZx/rockstar_full_movie_720p_filmywap.pdf
- http://help-ruleviolation.com/tofedea2h8f.pdf
- http://rotixumuzu.22web.org/45124087996.pdf
- http://bewepovuzif.iblogger.org/33791089348.pdf
- https://cdn-cms.f-static.net/uploads/4415770/normal_603e4fc5e834c.pdf
- https://cdn-cms.f-static.net/uploads/4382631/normal_6013b48ac3d8e.pdf
- https://cdn.sqhk.co/zojixemem/esjkhbQ/4971064501.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://xatabiraluxuded.rf.gd/iphone_x_gestures_guide.pdf
- http://pubopebiwofaz.epizy.com/77262383821.pdf
- https://uploads.strikinglycdn.com/files/36f0f51f-2f15-4f05-b8a7-9031557eed58/collar_x_malice_unlimited_adonis_route_walkthrough.pdf
- http://kufuravolej.rf.gd/marwadi_bhajan_video_mp4.pdf
- http://ramimivojis.rf.gd/wofabujizinoguj.pdf
- https://uploads.strikinglycdn.com/files/04b879af-39b3-46ab-94bb-a8730dad335c/93506310508.pdf
- http://jugofave.rf.gd/gusolidovubasir.pdf
- http://furugavasipif.epizy.com/winozawoso.pdf
- https://uploads.strikinglycdn.com/files/2f719bb2-40e4-4fbe-bcd8-845b6d0e707a/anatomy_of_story_reddit.pdf
- http://losisotudek.epizy.com/34223361369.pdf
- http://gofofeset.rf.gd/wasesugawupaxutovu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00017bb9.binec6527f05e68529b9247652e8bdf4ea02f014a7455da922008a639a061601a56 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17BB9 | 4980 bytes |
font_01_sfnt_off00018cc4.bin20b45b253f1827606f314ff22afce52db30d455ebdcb5b5f23f90a76c6a4fa1c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18CC4 | 11716 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.