MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains heuristics indicating an advance-fee scam lure, suggesting the user is being tricked into believing they have won a prize or are due a large sum of money. The document also contains an embedded URI pointing to a suspicious domain, likely intended to lead the user to a phishing or malware download site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=lg+bluetooth+headset+connect+to+ps4
- https://cdn-cms.f-static.net/uploads/4372673/normal_6059f2299b8e8.pdf
- https://cdn.sqhk.co/bawijodol/isEhjrv/40902564875.pdf
- http://fito4ka.xyz/jackson_the_lotteryy9y40.pdf
- https://cdn.sqhk.co/momajuxu/RohdoSw/no_sniper_rifles_fortnite.pdf
- http://xikubafo.iblogger.org/character_strengths_and_virtues_seligman.pdf
- http://xogubafirugufa.iblogger.org/druid_spells_pathfinder.pdf
- http://crystal-light33.ru/bank_of_america_address_for_wire_transfer_internationalwv0yn.pdf
- https://cdn.sqhk.co/nixivezez/djajdZn/23074693629.pdf
- http://shoop-fg.ru/4824255049e0227.pdf
- https://cdn.sqhk.co/fesakesovoka/b6Npgfi/move_whatsapp_from_android_to_iphone_after_setup.pdf
- http://kelularuj.22web.org/solutions_to_poverty_in_the_philippines.pdf
- https://cdn-cms.f-static.net/uploads/4485810/normal_600addcf29f28.pdf
- https://cdn.sqhk.co/xosujopi/gffgehf/rise_of_kingdoms_epic_commander_guide.pdf
- https://cdn.sqhk.co/wogokodu/nha3hiB/lejifajijemurokofo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_5f44cc0c82444cb38cafb803230a5bd0.pdf?index=true
- http://kesewalasefikef.epizy.com/me_before_you_movie_download_worldfree4u.pdf
- https://93bb5028-8b17-4c47-8ab9-f46a024b0e86.filesusr.com/ugd/041612_56affed9ff68499fa3f04e2537169a66.pdf?index=true
- http://govokaruvudup.epizy.com/pifalinozidetufi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f87b.bina0abb86ff2ae4d52e472f234ea54a99d430e75a990efcf84b88587f75d887d9d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF87B | 5408 bytes |
font_01_sfnt_off00010ae1.bin314ef0e87140abdf65943b7520eae72c3dfab13b38f9145956816e4b579d6696 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10AE1 | 10460 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.