MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it is a phishing lure. The embedded URL and the SE_BRAND_CREDENTIAL_PHISH heuristic confirm the intent to trick users into providing credentials. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a potential for exploiting PDF vulnerabilities or embedding malicious JavaScript to facilitate the phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9643
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://vitudanowule.weebly.com/uploads/1/3/5/3/135341415/8027299.pdf.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/award?keyword=ethnic+conflict+in+sri+lanka+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4384028/normal_6056b63c723b0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408718/normal_6031595d66cbf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370777/normal_604dbee44570e.pdfIn PDF document text
- https://vitudanowule.weebly.com/uploads/1/3/5/3/135341415/8027299.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462992/normal_6035942b24b90.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488116/normal_602ea14c8fae9.pdfIn PDF document text
- http://rajulikarizamu.iblogger.org/bosaleritusi.pdfIn PDF document text
- https://gawinesiti.weebly.com/uploads/1/3/5/3/135383431/6034842.pdfIn PDF document text
- http://mowisadewojapu.22web.org/dutofanuxuzamadaji.pdfIn PDF document text
- https://kiwaposuxixu.weebly.com/uploads/1/3/5/3/135329520/jilomebepixadosizox.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://tokavazeweg.epizy.com/netbeans_ide_for_mac.pdfIn PDF document text
- http://balesalefune.epizy.com/biwavave.pdfIn PDF document text
- http://muvabeso.epizy.com/98525227803.pdfIn PDF document text
- http://jitoritobo.epizy.com/99841997949.pdfIn PDF document text
- http://resaruxowepu.epizy.com/baidu_wifi_hotspot_for_pc.pdfIn PDF document text
- http://rakorasalonolit.rf.gd/14751169756.pdfIn PDF document text
- http://zixabolixugitu.epizy.com/38492517888.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91e46722-2214-4660-8e9e-1bcdbbb760c8/epson_xp-400_manual.pdfIn PDF document text
- http://geralumumavol.rf.gd/62312678727.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b49c3d3-c5f6-45d2-a3d3-0e681009414d/zurofapazefagox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e6970a4b-4102-4951-aa9e-5a713d981f68/tokyo_ghoul_season_3_does_kaneki_come_back.pdfIn PDF document text
- http://davidajepini.epizy.com/current_affairs_in_english_free_download.pdfIn PDF document text
- http://girodoge.epizy.com/19826145179.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://sinhala.sourceforge.net/In PDF document text
- http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
- http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002f89f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2F89F | 5264 bytes |
SHA-256: 2be5e186de5e35c56c9a771d44e8b1920c90558dec6cdfd6d261f12de22b89c5 |
|||
font_01_sfnt_off00030a82.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x30A82 | 4892 bytes |
SHA-256: 25aa00f07a264f6b8ad7e8caa4886cf67889735e255e59f1061b3b70b893c551 |
|||
font_02_sfnt_off00031bb9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x31BB9 | 9408 bytes |
SHA-256: 1685b1761a8d6d99a046c45be1cb33dd33575ddfd90bb91b1df808066b1fd58f |
|||
font_03_sfnt_off000337e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x337E1 | 12304 bytes |
SHA-256: f947e2ecba9bfb4cf2082a61000eb0e94484cfa05e3b0f073fc60e60f22d86cd |
|||
font_04_sfnt_off000360b4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x360B4 | 16164 bytes |
SHA-256: ead7fd593d7f5feef6f283420e9b55f8fa4552f107c64b0063d474dd3355abd8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.