MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or trojan distribution attempt. No scripts were extracted, but the presence of external URIs suggests an attempt to download further payloads or conduct phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=troy+bilt+gas+trimmer+head+replacement
- http://dommasters.site/99766605627wyv8v.pdf
- https://cdn.sqhk.co/xojurolaruk/hNSibzX/navalugunopa.pdf
- https://cdn.sqhk.co/junuxuseg/6ihgci9/word_connect_crossword_level_168.pdf
- https://cdn.sqhk.co/sesudegaruta/gj7qpig/wild_crocodile_sim_3d_mod_apk.pdf
- http://vvd.bar/plan_de_negocio_de_un_restaurante_vegetarianofaou3.pdf
- http://the-english-temple.com/how_to_restore_your_bodys_ph_leveltzzqr.pdf
- http://romeital.space/ramp_buggy_gtaw4597.pdf
- https://cdn.sqhk.co/nunexijezep/dgfIibn/30053111026.pdf
- http://static-start.top/71996178483ds1zl.pdf
- https://cdn.sqhk.co/joziroluxu/5q7X7FR/zekusinolamulurafinewex.pdf
- http://4gusevshop.space/degabupixizuvimupitublexx0.pdf
- http://spencermcman.us/howls_moving_castle_3rd_bookix7k0.pdf
- http://vinorama.fun/a_simple_favor_soundtrack_mp3_download9n6tg.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tidigudetefumof/29536098075.pdf
- http://ramimivojis.rf.gd/zawedaserovigudar.pdf
- https://s3.amazonaws.com/bakoloj/54403966981.pdf
- http://vaberizop.epizy.com/bobol_wifi_wpa2_dengan_android_tanpa_root.pdf
- https://s3.amazonaws.com/loxopudizus/information_technology_business_analysis_course_in_conestoga.pdf
- https://s3.amazonaws.com/dipafuxe/why_isnt_hbo_max_on_apple_tv.pdf
- http://wedemato.rf.gd/caprice_24_john_williams.pdf
- http://jeburam.epizy.com/nebobedexo.pdf
- http://mejesikuwuvaxax.rf.gd/antigone_fagles.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9f2.bin324ce071014f06e5d6e2827bc4e8744a8b0c52d223098fedfa48b7eb3abd2915 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9F2 | 5680 bytes |
font_01_sfnt_off0000fd1b.binc9846d1ae59cafe4f9eb22081515be9ebe459a09734eb2694e95e360926ab504 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD1B | 10588 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.