MALICIOUS
170
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious File
The PDF contains invisible and repeated links that lead to a ZIP archive hosted on Google's Firebase Storage. ClamAV identified this as Pdf.Trojan.IcedID, and ML classification further supports its malicious nature. The primary attack vector is the lure to download and execute the payload from the provided URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.8804
Heuristics 4
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
ClamAV: Pdf.Trojan.IcedID-9983376-2 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Trojan.IcedID-9983376-2
-
PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LUREPDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://firebasestorage.googleapis.com/v0/b/warm-airline-372420.appspot.com/o/QSPCMw89Wo%2FDocument_31.zip?alt=media&token=86396b49-df6b-4d9e-8aab-fb3f2215622a
Open this report in the interactive analyzer, or submit your own file for analysis.