MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffking.ru/123?utm_term=minecraft+mods+1.5+2+industrial+craft+2 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4414689/normal_5fccb3659b5cc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382973/normal_5fd611ef113ca.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372682/normal_5fbb3b08acd26.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7590e90e-7540-4852-a93e-44123b48dbeb/ralolurepunidamiv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/547862e1-027b-4b6a-b004-2e11617b0709/pitasoguxori.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0347718-7cf2-48ef-acd2-0f4701997ec1/8803582209.pdfIn PDF document text
- https://s3.amazonaws.com/liguwubore/luggage_size_guideline.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cca07e68-4a1f-441d-a7d4-70f3b229e636/el_duque_y_yo_julia_quinn.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1a177de-e7ae-4cce-b267-32af4b0d99da/97600934082.pdfIn PDF document text
- https://s3.amazonaws.com/pukaridimupo/6663058188.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab8d8974-51b3-451d-8903-5422714701d8/jab_tak_hai_jaan_mp3_download_djmaza.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f41ca16d-d47b-41a7-bf96-40ff43134b61/dawovunupazer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f1466dd-69ff-4346-bc79-ead878b2cc81/99781435231.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55d79ebf-9fa9-48d6-8bcd-201281fc92cb/bizigizito.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d43e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD43E | 5512 bytes |
SHA-256: f5a6bfccd4ee6317dadc5c2fb49b4c2a7d271e3af398c1ac643bf0f6972fee33 |
|||
font_01_sfnt_off0000e706.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE706 | 11080 bytes |
SHA-256: 03e1b605e5333ae20faf0511d86f4fd903731a6984eb9907f4de5d4636f2cb71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.