MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0'. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document's intent to trick users into downloading a password-protected archive. An external URI pointing to 'https://pelibifir.ru/award?keyword=certificado+medico+sector+salud+pdf' was extracted, suggesting a phishing lure related to a medical certificate.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/award?keyword=certificado+medico+sector+salud+pdf
- https://cdn-cms.f-static.net/uploads/4423431/normal_6021d178c23a2.pdf
- https://static.s123-cdn-static.com/uploads/4425910/normal_5fd09a2b9ef6e.pdf
- http://nuverlites.online/adobe_acrobat_xi_pro_setup_download7tj2q.pdf
- https://cdn-cms.f-static.net/uploads/4406202/normal_6020d59dba9a4.pdf
- https://cdn-cms.f-static.net/uploads/4408881/normal_6036571097fd9.pdf
- https://cdn-cms.f-static.net/uploads/4378827/normal_60352ec3eafe3.pdf
- http://doctora.club/jorulukojut6iim.pdf
- http://kukushka.space/marobaluduxrodc8.pdf
- https://static.s123-cdn-static.com/uploads/4426549/normal_5fec0b93d063d.pdf
- http://whitecheat.xyz/rupanoxadepisufod58arf.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://sidepojedava.myartsonline.com/best_application_letter_for_a_job.pdf
- https://uploads.strikinglycdn.com/files/5cdff966-bad0-4b76-8744-6b673e8772e0/videgixojanefemirololude.pdf
- https://s3.amazonaws.com/zifilobesumafi/iot_project_report.pdf
- https://uploads.strikinglycdn.com/files/cda188e6-c8f5-4945-840a-8d84d9744ef8/new_testament_chronological_reading_plan.pdf
- https://uploads.strikinglycdn.com/files/69ec8939-56ec-410f-a1d2-00bcee82d089/96429403541.pdf
- https://s3.amazonaws.com/wobuzisibal/geometrical_isomerism_notes.pdf
- https://s3.amazonaws.com/pipaneku/91926287889.pdf
- https://s3.amazonaws.com/fajujiju/18706510414.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012f14.binfc5d7261a77462c73a364c6ac772bd2d2fd15eecb2a9a3e4de4b2fdd052a5a5a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12F14 | 5208 bytes |
font_01_sfnt_off000140af.bindfbb17be88613587cebd035566521148a564746693d115e59d0b538766ed91a4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x140AF | 12016 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.