MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of an external URI. The embedded URL, https://bologen.ru/wix?keyword=kensuke%2527s+kingdom+worksheets, is likely used to deliver a malicious payload or phish for credentials. The document body, though heavily obfuscated, suggests a lure related to 'Kensuke's kingdom worksheets', aligning with a phishing or social engineering attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/wix?keyword=kensuke%2527s+kingdom+worksheets
- https://cdn-cms.f-static.net/uploads/4391954/normal_602495ce23800.pdf
- https://cdn.sqhk.co/xorilulog/miJgjji/space_trader_games_pc.pdf
- https://cdn.sqhk.co/makubeku/gjicRij/76701846142.pdf
- http://gizovivomiz.getenjoyment.net/gukemux.pdf
- https://static.s123-cdn-static.com/uploads/4480594/normal_5fff70706a5e6.pdf
- https://cdn.sqhk.co/nojedajoze/eiewidW/how_to_write_a_simple_business_plan_template.pdf
- https://cdn-cms.f-static.net/uploads/4459805/normal_600b211395802.pdf
- https://static.s123-cdn-static.com/uploads/4375894/normal_5fffcb6ab440a.pdf
- https://cdn-cms.f-static.net/uploads/4387703/normal_5fdb687c39d2c.pdf
- https://static.s123-cdn-static.com/uploads/4459470/normal_5fe1709031136.pdf
- http://vogudikomi.getenjoyment.net/lorubaxifubev.pdf
- https://cdn-cms.f-static.net/uploads/4484631/normal_5fda8b0c3cd38.pdf
- http://zinazeripu.22web.org/adjetivos_en_ingles_con_imagenes.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://kogusox.epizy.com/dulebajapawete.pdf
- https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_3c3f8fb93f6e4d048a3c522948481019.pdf?index=true
- http://vobikeretuwof.atwebpages.com/befefolawufowiru.pdf
- http://dawutanarav.epizy.com/worksheet_for_speaking_practice.pdf
- https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_ad05c2ce2a89405fbde3063797dcfd43.pdf?index=true
- https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_42afa31a6b9548faa9dd77d29b3e3263.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c9df.binb18aef9834eb27c4a0b599ddd5b6ab13d43e460857afa5798b80c4c98e6492c7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC9DF | 5156 bytes |
font_01_sfnt_off0000db5b.binec838360c94937908af4dffa2c508f756ba9ddeeea63f5ddf54d9dec1cc6259e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB5B | 10508 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.