MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as Pdf.Phishing.Trojan. The embedded URL and document body suggest a lure related to 'minecraft pe 15.0 apk', indicating a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=minecraft+pe+15.0+apk
- http://naturaitalia.space/reformas_borbonicas_cchtqsq9.pdf
- https://cdn.sqhk.co/zadoweferoxe/miihehf/13434250261.pdf
- https://cdn.sqhk.co/lazuxorus/fgfhDjd/wilderness_survival_kit.pdf
- https://cdn.sqhk.co/nagigureti/UheZTHk/51654162840.pdf
- https://static.s123-cdn-static.com/uploads/4472204/normal_5fcca86c378fe.pdf
- https://cdn.sqhk.co/jigotove/kJhe2SC/margaritas_near_me_delivery.pdf
- https://cdn-cms.f-static.net/uploads/4461786/normal_5fd90389a6928.pdf
- https://cdn-cms.f-static.net/uploads/4424981/normal_602ed58444abd.pdf
- https://cdn-cms.f-static.net/uploads/4500201/normal_6020be8dc5ea9.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/bd2200ef-8de8-4cb1-8608-1b1acf3e0530/setting_up_a_post_office_savings_account_for_a_child.pdf
- http://kefixofelapadi.epizy.com/48213533542.pdf
- https://uploads.strikinglycdn.com/files/2e01a374-7f98-4b42-86c1-27225afc36bc/far_from_the_tree_documentary_trailer.pdf
- https://uploads.strikinglycdn.com/files/724fb2f9-ea84-43f8-a41e-0cabdd691743/bixava.pdf
- https://s3.amazonaws.com/pexodugosa/jira_confluence_templates.pdf
- https://s3.amazonaws.com/tobito/adding_fractions_and_mixed_numbers_worksheet.pdf
- https://uploads.strikinglycdn.com/files/6d8b4b25-4edf-42e1-903b-83c378c1e8db/the_little_match_girl_summary_questions_and_answers.pdf
- http://fiviwuzovalexop.rf.gd/rajasthan_b._sc_nursing_online_form_2018.pdf
- https://s3.amazonaws.com/neporezofov/sexipejidedeb.pdf
- https://uploads.strikinglycdn.com/files/71acdb92-67a0-4be6-b00a-38a7d49bf398/film_storyboard_software_free_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c784.bin9395e1435e2a059c0754a20cd92919920ae5633cb5d24db021b155184bf8c8a0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC784 | 5220 bytes |
font_01_sfnt_off0000d976.bin4d01c8b7dda2b4dbb0d0ddb57904770f4dcd736ee199177606a692af9ba1409e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD976 | 10024 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.