MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an embedded URI pointing to 'dafemum.ru' suggests a phishing attempt to trick the user into downloading a potentially harmful application. The document body, though heavily obfuscated, contains references to 'Mayfair apk firestick' and 'wkhtmltopdf', further supporting the lure of a fake application download.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/wix?keyword=mayfair+apk+firestick
- https://cdn.sqhk.co/famuxina/pgfifRv/dijerifamadidunodonuge.pdf
- http://best-store.club/catan_classic_apk_espaol80951.pdf
- https://cdn.sqhk.co/budajawisore/bhiZUha/stick_cricket_live_best_cards.pdf
- http://betixisu.22web.org/78561644573.pdf
- http://gasurorir.sportsontheweb.net/25580184734.pdf
- http://mikovil.mywebcommunity.org/bakexena.pdf
- http://pifesato.iblogger.org/pafapebasexesa.pdf
- http://cccckkkkkdd.space/kavokike84rx3.pdf
- https://cdn.sqhk.co/xonarewu/eijLrjc/54695954622.pdf
- https://cdn.sqhk.co/zadoweferoxe/ggZgjhO/vopokisetilawivusokisu.pdf
- https://cdn.sqhk.co/soziwariru/9hhUrja/verizon_care_smart_app.pdf
- https://cdn.sqhk.co/jitolado/ldva1xL/93602052587.pdf
- http://miromawetibikew.mywebcommunity.org/kidoxo.pdf
- http://xunarepozufuz.mygamesonline.org/friendship_story.pdf
- https://cdn.sqhk.co/ruwonumatag/jNgdx2r/wallpaper_lock_screen_iphone_7.pdf
- https://cdn.sqhk.co/fumodolanes/hibRid3/84074998392.pdf
- http://brosbass.com/sexudmrutj.pdf
- http://latencfsrt.space/xetumizawoxatepanaurt00.pdf
- http://kexedoliresile.22web.org/lavobimoxamajudagapamop.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/fobupojowojon/hp_elitebook_x360_830_g6_datasheet.pdf
- http://vugugemo.atwebpages.com/kegenapipemiwetowa.pdf
- http://gagarereforer.epizy.com/idlewild_park_coupons_sheetz.pdf
- https://s3.amazonaws.com/xonaxevetaf/estar_formal_command_ustedes.pdf
- http://dakezimipage.epizy.com/que_es_anemia_falciforme.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dfb3.bine6bb7f1246e5ada857e40ee99d5f57f3a0260b2b540204c9d8e4821940a82807 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFB3 | 5148 bytes |
font_01_sfnt_off0000f167.bin7435825b7bf200e7acf83710535ae6365b4a8cc1bb109f1632ceb3ae538d1ef4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF167 | 11128 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.