MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URL pointing to a suspicious domain, and a heuristic indicates it's a lure for a password-protected archive. This suggests the document is part of a phishing or malware distribution scheme. The ML classifier also flagged this PDF with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=super+mario+galaxy+2+guide+book
- https://static.s123-cdn-static.com/uploads/4413838/normal_5fdd392d6e530.pdf
- https://static.s123-cdn-static.com/uploads/4408483/normal_5fe526df8c9f8.pdf
- https://cdn-cms.f-static.net/uploads/4462046/normal_5fe7927a9eab8.pdf
- https://cdn-cms.f-static.net/uploads/4458421/normal_605cb92499aaf.pdf
- https://cdn-cms.f-static.net/uploads/4460255/normal_5fd252ed26d7c.pdf
- https://static.s123-cdn-static.com/uploads/4426080/normal_6000d6e317c43.pdf
- http://lopitimew.mygamesonline.org/grade_9_math_worksheets_with_answers.pdf
- https://cdn-cms.f-static.net/uploads/4465397/normal_604e2d0c9cc25.pdf
- https://cdn-cms.f-static.net/uploads/4368251/normal_600d78b9b4417.pdf
- https://cdn-cms.f-static.net/uploads/4480174/normal_5fda6ce4ceede.pdf
- https://cdn-cms.f-static.net/uploads/4421342/normal_5fe89dfb34b7d.pdf
- http://tuzogat.sportsontheweb.net/19504819862.pdf
- http://ziwusis.getenjoyment.net/cirrhosis_treatment_guidelines.pdf
- https://static.s123-cdn-static.com/uploads/4472788/normal_6006bba83cb60.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/62f181ca-a107-463e-bc90-7868164977bf/99820683512.pdf
- https://uploads.strikinglycdn.com/files/0e58e300-aa47-4ce8-80b2-76bfcc244d58/pistola_airsoft_spring_cybergun_sig_sauer_p226_slide_metal.pdf
- https://uploads.strikinglycdn.com/files/9cb31d25-e71b-4115-b908-c62ba4e73b97/apa_format_reaction_paper_example.pdf
- https://uploads.strikinglycdn.com/files/ef876aed-18ba-4ee8-a898-4917e4cb87e2/suunto_vyper_battery_indicator.pdf
- http://jifisuxevizek.myartsonline.com/4677920268.pdf
- https://uploads.strikinglycdn.com/files/8cf37f10-06d2-44f7-bdd1-64a8c488dbbf/2004_ford_focus_wagon_reviews.pdf
- https://uploads.strikinglycdn.com/files/c3ea9856-3164-401b-81e5-5a5e8a6237e8/mojuxu.pdf
- https://uploads.strikinglycdn.com/files/9ce17391-5ef1-4375-b574-3d1cc65f3a75/how_do_i_find_out_what_year_my_samsung_smart_tv_is.pdf
- https://uploads.strikinglycdn.com/files/954cdd5d-0993-4b9a-9e57-93b42e9ef46b/74306566762.pdf
- https://uploads.strikinglycdn.com/files/e82f58d2-9aac-410d-a8c1-5a65ddc80270/86198779230.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f09b.bin50d93eda21d84dd7360e3a29fd2903f9292bfdc030f776b6a229e4b8e45f9a5b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF09B | 5712 bytes |
font_01_sfnt_off000103fe.bind698c8bb01d2dd79258dcfc64a1baabc518f8269e973abdaa3cf368c975b36d1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103FE | 10460 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.