MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/123?utm_term=chennai+gana+songs+new PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://uploads.strikinglycdn.com/files/7926545f-e949-4ff1-8f69-0c66652173ce/60028212928.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3ef3041-596c-4374-96ae-1d0e77bb8b56/delonghi_rotisserie_convection_oven_recipes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/799b02f3-800a-4d06-bdec-08e87248c71f/vosat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/104b1b0b-6fa2-4fc8-878e-9134a9e5853b/the_rainbow_fish_bath_book_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ea224397-d534-4961-b78a-c28fef5de0b1/90871014187.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/358e1f42-ffa7-47d5-b713-58e9404bcd4a/redemption_song_bob_marley__the_wailers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4eabef9c-23df-4783-ade6-687e91247e30/judojiwiresesigesovoxek.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/154213d7-0c8d-4a1c-9b55-ce53497175f1/saxon_math_course_1_2012_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ccb6311-de42-401e-870f-3407124302ea/fefurumaxiditefidomej.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d11815d8-b1c2-4a42-807b-6f3927b0cc8c/how_to_make_candy_canes_out_of_pipe_cleaners.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec27e5d8-59f6-408f-a548-30685adc010d/kirinofaxedojemin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e74cf57a-a86e-4fdb-bfdc-ad63375eaae0/tulezoripuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/320524da-fc0b-491f-94ef-95f7cf56cb12/counting_chart_numbers_1_to_500.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b810fc5-8488-48a6-95ce-b99f3ae04d4b/tissot_racing_touch_manual_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa926d34-519f-4e4c-89d3-485d0bca549e/replacement_screws_for_sanyo_tv_stand.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be183fb8-ec84-41b9-a555-b1299dd7099c/self_leadership_and_the_one_minute_manager_book_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/617b68a7-d0f1-4c30-9210-bc6ee4ba1acd/30279018157.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5c6c02e-4b88-47ef-b9b7-654cb74a809e/how_to_connect_my_pixma_printer_to_wifi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f634620b-2677-46e6-b17e-7654b1f6cc79/kumaxuba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c114ca6e-ef8c-4d64-aaed-1cf9e2454ada/sch3u_charles_law_worksheet_answer_key.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c20d2352-8fed-40b3-b36a-c411ab1bae4e/69635845064.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87c51276-bda9-4faf-a378-8d7687808922/international_finance_center_india.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e436.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE436 | 4816 bytes |
SHA-256: 7c596fabca4407d3cc3fe6b14b651827a0f10ca55faea66942aa4de0e7629dda |
|||
font_01_sfnt_off0000f4a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4A5 | 6488 bytes |
SHA-256: 3036a09086e53ea8e8941ded7aa1abdc9833bc85653693ffb31da43edbb02ba5 |
|||
font_02_sfnt_off0001085f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1085F | 3812 bytes |
SHA-256: fc39313cd5cec93167b0373ede31a99ce4d5df96fb5debe5090c898f01328917 |
|||
font_03_sfnt_off00011638.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11638 | 11280 bytes |
SHA-256: 178af150975de804225fb3ff111b3cf83ba301643077f92c96c2d11ab35bb8b5 |
|||
font_04_sfnt_off00013c5a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13C5A | 16656 bytes |
SHA-256: 812bd1bdc79e18d136e9ad5ece2dd453037d630a9f5bc8dc05008dc560d81e40 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.