MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. An embedded URI points to a suspicious domain, suggesting a phishing or malware distribution attempt. Although no scripts were extracted, the PDF structure and the presence of an external URI strongly indicate a malicious intent to redirect the user.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=storm+king%2527s+thunder+roll20+review PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/d1594776-af97-4053-b4ab-7bf18dbbdb9e/22436255189.pdfIn PDF document text
- https://s3.amazonaws.com/wetevali/10345041037.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0273ec82-0e61-4a5c-9e5f-401b4b1963f5/gitidozolokizevixo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/094ac366-4415-4530-ad2d-ba28f6c3d552/how_to_reset_ps_gold_headphones.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8464f6d-ba4a-456e-b32b-dfaec5ca6fe0/schwinn_ad2_airdyne_exercise_bike_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b25986bf-db0d-4fc7-a818-f43a57552110/12017173907.pdfIn PDF document text
- https://s3.amazonaws.com/muwemivumazulax/gigixiguxu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cdf8271f-3411-40b7-8295-73b0fb5b7532/how_to_handle_teenage_anxiety.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e8a0c0dc-f3f8-4b76-ad15-36449bf5e090/how_long_it_takes_to_study_for_usmle_step_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3220b32-f899-45ef-9a14-94ab84dc7fe4/narrative_of_the_life_of_frederick_douglass_chapter_1_summary.pdfIn PDF document text
- https://s3.amazonaws.com/patotale/ps2_emulator_for_psp.pdfIn PDF document text
- https://s3.amazonaws.com/gonasidupij/what_was_happening_in_america_in_1787.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f431f32f-f1b6-46bc-8d46-89f5f772bee3/35215372779.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5831f86-28eb-4f4e-b899-e94b99dc50fd/84244194639.pdfIn PDF document text
- https://s3.amazonaws.com/wazorixekunafob/receptive_language_activities.pdfIn PDF document text
- https://s3.amazonaws.com/gewuwasi/arrl_books_free_s.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ac4e7a8-c6b5-47ae-b7bc-2afb916b35bb/easy_english_grammar_exercises.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e20debbb-ea9d-4867-9887-260eefb051e2/xatobomitajejefenefeso.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55d67502-08c3-400b-bef7-76e706ed3b25/83029357713.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28748319-fddd-4905-ac8a-160e1613a8e8/kavivipenexigokovudo.pdfIn PDF document text
- https://s3.amazonaws.com/nijudow/45373331934.pdfIn PDF document text
- https://s3.amazonaws.com/zoromexemuzid/head_first_design_patterns.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76803c36-6f8c-477b-a09b-b7644257db8d/casio_gw-9400_manual_espaol.pdfIn PDF document text
- https://s3.amazonaws.com/ribowexulo/english_worksheets_for_grade_4_south_africa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf454f8f-e432-4829-8454-c1d09c5a8607/46274366575.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000107ef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107EF | 5540 bytes |
SHA-256: 9b4d539fc130c09969ed55daf4e2836193c83e925926564c2517f2f278c97257 |
|||
font_01_sfnt_off00011aa9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AA9 | 11828 bytes |
SHA-256: 046c7622cf693e9c3ae87a7c9a3bc061ad7ee7bf1fac2ce329e8769e2c18fa89 |
|||
font_02_sfnt_off0001425e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1425E | 4324 bytes |
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.