MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. An external URI pointing to 'jacksth.ru' was extracted, suggesting a potential phishing or download lure. The document body is heavily obfuscated, but the presence of an external URI and the nature of the ClamAV detection point towards a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/award?keyword=grade+2+math+worksheets+pdf+ontario
- http://wexoxunesixu.iblogger.org/fosijoba.pdf
- https://cdn.sqhk.co/besogevipadi/FIhfoaP/63642653383.pdf
- https://cdn-cms.f-static.net/uploads/4409826/normal_5fd146a3eb72a.pdf
- https://cdn.sqhk.co/nuvurero/jcV9hd8/roller_guide_meaning_in_tamil.pdf
- https://cdn-cms.f-static.net/uploads/4465402/normal_60385cf500605.pdf
- http://kudopifupelixi.22web.org/kubota_l3010_owners_manual.pdf
- https://static.s123-cdn-static.com/uploads/4379049/normal_5fc7671e1a0cd.pdf
- https://static.s123-cdn-static.com/uploads/4476427/normal_5fcf61a92e675.pdf
- https://cdn.sqhk.co/lunosupi/kojb8ib/adventure_capitalist_hack_pc_2019.pdf
- https://cdn.sqhk.co/navififoro/LHjizqV/workforce_planning_steps.pdf
- https://cdn.sqhk.co/badexejos/if42jgP/edit_word_online_for_free.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://sivinufedumoja.rf.gd/sorting_and_searching_algorithms_in_c.pdf
- http://mulukamuzadesew.epizy.com/action_plan_format_for_sales.pdf
- http://xatonidimo.rf.gd/fobovuja.pdf
- http://vomematomeze.epizy.com/wasewe.pdf
- https://6a9ecc2b-05c3-4056-8705-773ae6be8cdd.filesusr.com/ugd/7a359d_db2effba17f2436eb156c0ce56d4a31a.pdf?index=true
- https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_a0e2cf3d4d5d44e69d21f36485aeca01.pdf?index=true
- https://98be45bc-63b9-4117-aff7-84a3d4f2c4a0.filesusr.com/ugd/90c678_6c63191b50084307bf30207239615871.pdf?index=true
- https://91e55214-10ad-44cf-a10a-60a9392df58b.filesusr.com/ugd/e1c37d_76b99086dda24113a82b30ab1c36923a.pdf?index=true
- https://7f06b679-e14d-4525-8955-d56a7cf6f710.filesusr.com/ugd/79e5df_a55e4429b5c446fdbf82334eee6c20af.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010696.bin806468e5d22df1478ed8ab59d6a8c837b7766caee59c6e549a32c90d441be1ea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10696 | 5568 bytes |
font_01_sfnt_off00011976.bineee4a56461a9a33e6dccba05935092097bd3a2d7536c70379e1b26aa2a7976fc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11976 | 10968 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.