MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host or redirect to a malicious payload. The document body, though heavily obfuscated, suggests a lure related to 'industrial biochemistry books pdf', aligning with a phishing or social engineering pretext.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/123?utm_term=industrial+biochemistry+books+pdf
- https://static.s123-cdn-static.com/uploads/4393644/normal_5fc9e1df3e5e6.pdf
- https://cdn-cms.f-static.net/uploads/4381289/normal_60370d40a94eb.pdf
- https://static.s123-cdn-static.com/uploads/4459796/normal_5ffd05dd1aa10.pdf
- https://cdn.sqhk.co/batovafakupo/jidGVwu/rebel_racing_mod_apk_unlimited_money_android.pdf
- https://cdn.sqhk.co/wubofuse/rVhiii0/ditirubugasizu.pdf
- https://static.s123-cdn-static.com/uploads/4417675/normal_5fffe7f4d92af.pdf
- https://cdn.sqhk.co/netesatova/aid6ihV/53810764995.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a8139783-5bf2-404f-b23d-911a6bc8eb14/how_much_does_geotech_cost.pdf
- https://s3.amazonaws.com/resisuna/74406991055.pdf
- https://uploads.strikinglycdn.com/files/67bc68d8-97df-44ae-a3e1-63846789dc62/authors_purpose_worksheet_6.pdf
- https://uploads.strikinglycdn.com/files/3172dddf-cd17-4e34-9024-ad3a606cf0bd/sozisetifejugaxetoforufex.pdf
- https://uploads.strikinglycdn.com/files/0a536bf5-2295-4424-ab2a-3cbad7b12916/woxomexuwutemajitisig.pdf
- https://s3.amazonaws.com/farezelof/49902608660.pdf
- https://uploads.strikinglycdn.com/files/2ec32f48-e135-4812-abe3-7bebab59f006/75299233086.pdf
- https://uploads.strikinglycdn.com/files/9410a5cc-9436-4d39-9f40-69eb2d647149/3434921957.pdf
- https://uploads.strikinglycdn.com/files/d2bc4ad9-dbb0-458f-a29b-c2a6d1ac7550/21721894615.pdf
- https://uploads.strikinglycdn.com/files/0580b16d-2e4c-464c-abfa-288ca324405e/28120184632.pdf
- https://uploads.strikinglycdn.com/files/1307d000-fb84-4dfc-afb8-f5c4a83656ad/dopilujuzonaw.pdf
- https://uploads.strikinglycdn.com/files/317a5cba-b70c-4208-b05d-87f0115da601/kanemekemodalinem.pdf
- https://uploads.strikinglycdn.com/files/3c32df68-f4d5-4124-a279-4eb2598e1b77/how_to_make_a_rounded_corner_triangle_in_photoshop.pdf
- https://uploads.strikinglycdn.com/files/47da40bf-3115-4e20-add1-9314e11bb957/dirt_devil_easy_lite_canister_manual.pdf
- https://uploads.strikinglycdn.com/files/5119867c-c837-48f1-afbb-9bb3a73e23cf/mexop.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000116e8.binffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x116E8 | 6744 bytes |
font_01_sfnt_off000127d0.binbaab56306f9b2c47f96e9e49b6b266000372e01b2a1793fd4c4eb181610a1385 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x127D0 | 5636 bytes |
font_02_sfnt_off00013ad1.bin79b5aa75f51a083aa047eff786a6b38878a6bc789261e3cc8822e91d8e58a2ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13AD1 | 10944 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.