MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, appears to contain text related to the URL's UTM parameters, suggesting a phishing or scam attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffset.ru/aws?utm_term=simple+present+negative+form+structure
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/nufidibodudulad/jajoralamatage.pdf
- https://uploads.strikinglycdn.com/files/673d38e4-2f30-47cc-96d1-7fda52824d17/costa_rica_gun_laws.pdf
- https://uploads.strikinglycdn.com/files/0f73d9ec-e054-44df-b125-32945aa5a094/triple_integral_convert_to_cylindrical_coordinates_calculator.pdf
- https://uploads.strikinglycdn.com/files/a09c2192-7278-4ee4-847f-3053b204b05f/bitimoronunun.pdf
- https://uploads.strikinglycdn.com/files/510a313f-6c0f-48ad-8e01-12616769cf7c/nebojinipexakinixemerufiz.pdf
- https://s3.amazonaws.com/daniwodug/alexander_hamilton_biography.pdf
- https://uploads.strikinglycdn.com/files/dece861f-0fc1-424d-852d-28b1ad3857e6/duo_therm_dometic_thermostat_3107541.pdf
- https://s3.amazonaws.com/tobaziw/google_sheets_if_switch_statement.pdf
- https://uploads.strikinglycdn.com/files/7cbf4c42-96c5-4f1f-9332-6773ff296de7/how_to_download_music_from_youtube_onto_iphone_xr_windows_10_free.pdf
- https://uploads.strikinglycdn.com/files/871e75dc-fc85-4d22-8e6a-c83f07c799e6/vimafalofaxinusumibazago.pdf
- https://uploads.strikinglycdn.com/files/ec525244-691f-41a2-9fc5-f44a2d64eaa5/diagrama_de_mollier_agua.pdf
- https://uploads.strikinglycdn.com/files/93436079-8f6a-4806-8b42-5a25f5636a50/mankiw_macroeconomia.pdf
- https://uploads.strikinglycdn.com/files/2861ed33-f87d-4928-b040-ca814d579d7c/68239125593.pdf
- https://uploads.strikinglycdn.com/files/ca2db006-ffab-4444-982c-2203569ed60b/fotakufutuf.pdf
- https://uploads.strikinglycdn.com/files/a6e29da6-d816-44f7-a016-fe2263f37841/runanorefa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d5ad.binc89f8006bf258332ae44b35b09269fc3a507e7aa35a4ff173f158f61143724b6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD5AD | 5500 bytes |
font_01_sfnt_off0000e852.bin8b8dbbfeaaa33ce1d4e2e6584a3f1a3ec177e3bd6e538d977a6f73ccf247b066 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE852 | 10832 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.