MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a URL that promises a "Psn code generator online 2020", indicating a phishing or scam attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=psn+code+generator+online+2020
- https://gabejopow.weebly.com/uploads/1/3/4/5/134597712/9cc99d.pdf
- https://woxogobigevi.weebly.com/uploads/1/3/0/8/130814596/2953676.pdf
- https://cdn-cms.f-static.net/uploads/4419827/normal_5fe948ba9bbcd.pdf
- https://static.s123-cdn-static.com/uploads/4368229/normal_5ffa298267c9d.pdf
- https://muragifenujokuf.weebly.com/uploads/1/3/1/1/131164382/64211.pdf
- https://noloxuxema.weebly.com/uploads/1/3/1/4/131453633/1166af0.pdf
- https://lejujazu.weebly.com/uploads/1/3/5/3/135337057/03fc93f9.pdf
- https://cdn-cms.f-static.net/uploads/4370541/normal_6028bdc642b49.pdf
- https://wifuduwelu.weebly.com/uploads/1/3/2/8/132814355/biwofuloben-fadikepamigisig-wexovape-kadeb.pdf
- https://pifaxatopegamu.weebly.com/uploads/1/3/4/1/134108845/zenaseda.pdf
- https://wumetitazidizo.weebly.com/uploads/1/3/4/8/134885052/5368191.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fukesok.rf.gd/translations_in_coordinate_plane_worksheet.pdf
- http://voferinokubusob.rf.gd/education_responsive_html_template_free.pdf
- http://janofegiwene.epizy.com/plantronics_backbeat_pro_2_connect_to_tv.pdf
- http://fibubaxuvuvixik.epizy.com/motudomumidakepu.pdf
- http://jidoreno.epizy.com/59968784017.pdf
- https://s3.amazonaws.com/liguwubore/android_9_zenfone_4_selfie_pro.pdf
- http://nosorozu.epizy.com/99983585764.pdf
- https://s3.amazonaws.com/gizonukorad/kopier_betinget_formatering_excel.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000103de.bin3214fd5b3dcc06120c9e989e1d60be6a00a759fd786c3b1407bb64df5f4e2793 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103DE | 5380 bytes |
font_01_sfnt_off00011634.bin5091eb1dd2bef9bd175f407cc9112db5b9248bed3a6a687131723162b688c266 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11634 | 10872 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.