MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF containing obfuscated text and an embedded URL, strongly indicating a phishing attempt. The ML classifier and ClamAV detection confirm its malicious nature. The primary URL, https://golowaki.ru/award?keyword=certificado+de+preparatoria+falso+pdf, suggests a lure related to a fake certificate, likely to trick users into downloading further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/award?keyword=certificado+de+preparatoria+falso+pdf
- http://mozujana.22web.org/zexovegebezadatas.pdf
- http://ketousa.site/how_to_use_black_jack_felt_adhesivehbcfv.pdf
- http://mimivamefigupe.sportsontheweb.net/current_affairs_january_2020_in_english.pdf
- https://lozofedexipa.weebly.com/uploads/1/3/5/9/135969573/tuzajuradezoji.pdf
- http://xomunuxeju.sportsontheweb.net/plantronics_backbeat_pro_5100_vs_galaxy_buds_plus.pdf
- https://cdn.sqhk.co/moxibusas/qghhcje/gomo_phone_coverage.pdf
- https://fotavimapuwe.weebly.com/uploads/1/3/2/8/132816041/eb6bb63bbf702.pdf
- https://wovupidej.weebly.com/uploads/1/3/4/6/134687137/6427519.pdf
- https://cdn.sqhk.co/nanagajog/fDsMj9t/super_smash_bros_ultimate_tier_list_mkleo.pdf
- https://cdn.sqhk.co/xolanikipiz/shdFidG/gaming_wallpapers_for_pc_1366x768.pdf
- https://cdn.sqhk.co/jolurakokulo/yvrgjgd/jadazefodiruviwojamem.pdf
- http://kfnwejfnkwheklf.space/yiruma_maybe_sheet_musicjhcxq.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_c26d1c60daca466fbc5111d153ccca62.pdf?index=true
- http://wiwosotu.myartsonline.com/how_do_i_factory_reset_my_swann_security_system.pdf
- http://rowezezivifa.epizy.com/functional_and_nonfunctional_requirements_for_library_management_system.pdf
- http://mevonaku.rf.gd/abstraction_in_java_with_example_program.pdf
- http://rukosivujuxu.atwebpages.com/what_is_a_subacute_rehabilitation_facility.pdf
- https://cf075d60-af7c-4c71-a16c-5c8c125a9bb7.filesusr.com/ugd/cc03df_bee3e1a2b3854b858e8352d7333189ae.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f642.bin85fbee1588e2adf622eae582bffe34d0a3d1e35a5b5b0c68d131f4485b8b7373 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF642 | 5052 bytes |
font_01_sfnt_off0001077e.bin7eefbb37d0f166c7a4ee4b4f97a3bbef34ced8047feac5f10889931be7b5cd7b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1077E | 11624 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.