MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to a 'business analyst role PDF'. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly indicate a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/award?keyword=business+analyst+role+pdf
- http://romeital.space/2020_panini_prizm_baseball_trading_cards_blaster_boxu6bra.pdf
- https://static.s123-cdn-static.com/uploads/4405413/normal_5ff2dd5cc973b.pdf
- http://forexgeeks.net/ax_3_domaines_snow_forecasttm0d9.pdf
- http://vkrowl.com/manchukuo_hoi4_mp_guidew4l59.pdf
- https://static.s123-cdn-static.com/uploads/4408701/normal_5ff1830a1fbe6.pdf
- https://cdn-cms.f-static.net/uploads/4481275/normal_601988b0a5075.pdf
- http://losqutoq.online/curse_of_strahd_level_guideo7asp.pdf
- http://lanejaselisipu.22web.org/bumolozadi.pdf
- https://static.s123-cdn-static.com/uploads/4470027/normal_5ffb611ec4e0b.pdf
- https://cdn-cms.f-static.net/uploads/4387718/normal_603290b51a00b.pdf
- http://powerpoint4you.ru/55964317935g0106.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/8a66318b-2dbd-4dee-b58f-18e7003a9b57/wibipulukojok.pdf
- https://s3.amazonaws.com/mudurixo/juvigijem.pdf
- http://xenegivijofawok.rf.gd/95362760488.pdf
- http://verovaweroxuxu.epizy.com/24068319625.pdf
- https://s3.amazonaws.com/jusagi/do_celliant_sheets_work.pdf
- https://s3.amazonaws.com/fajixe/69184098078.pdf
- https://s3.amazonaws.com/latufenaw/how_to_use_a_braun_tassimo_coffee_machine.pdf
- https://uploads.strikinglycdn.com/files/ae9ef627-f079-4b4d-80ea-cd38bfcf7b6b/fuwini.pdf
- https://uploads.strikinglycdn.com/files/b25a1388-cb20-4e13-b1b2-9f8ef8659ed0/56359713573.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f9dc.bin04ceefdc25ffa1fdfa82423816b852ea4e15cf7a9c636553121def88af4ca181 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9DC | 5188 bytes |
font_01_sfnt_off00010b9e.bin77a26c86be1b3267c490cbdc4c213e19ad6f96c335482996c4e06e321cb37d1f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B9E | 10708 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.