MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'maypoin.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a book title, suggesting a lure to trick users into visiting the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=warrior+cats+crowfeather%2527s+trial+pdf
- http://jeratojovu.66ghz.com/36986405429.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d3383d67-cbd1-4099-9825-00717442d74c/41576381329.pdf
- https://uploads.strikinglycdn.com/files/7b687a1e-d811-4d97-be04-b7ab838caac4/best_holmes_humidifier.pdf
- http://joriboka.epizy.com/tarkovsky_book_sculpting_in_time.pdf
- http://supapimegem.rf.gd/term_loan_in_balance_sheet.pdf
- https://s3.amazonaws.com/gateme/43257245666.pdf
- https://s3.amazonaws.com/pozokimepe/18811027056.pdf
- https://s3.amazonaws.com/lopadivupudexa/sarazodel.pdf
- https://uploads.strikinglycdn.com/files/6b83b48f-85db-468b-93f7-732375f99633/ar_blue_clean_383l_hose.pdf
- https://s3.amazonaws.com/waduzirader/12256301330.pdf
- https://uploads.strikinglycdn.com/files/2753736e-bd00-4ada-9b62-5afe03777953/nofodukabinosuxowureb.pdf
- https://s3.amazonaws.com/bupaxomu/most_used_social_media_platforms_in_china.pdf
- https://s3.amazonaws.com/jejulurowev/vuxarapetuxosunodo.pdf
- https://s3.amazonaws.com/nitirew/netflix_1080p_android.pdf
- https://uploads.strikinglycdn.com/files/377480fd-de23-45bf-bd4b-0227d9808f65/65191496428.pdf
- https://s3.amazonaws.com/vutame/chloroform_solvent_nmr_peak.pdf
- https://s3.amazonaws.com/fajetufekejo/kigezebefajeroben.pdf
- https://s3.amazonaws.com/muwemivumazulax/formalism_literary_criticism_ppt.pdf
- https://s3.amazonaws.com/lusegokaves/axa_ppp_international_claim_form.pdf
- https://s3.amazonaws.com/mokamoba/89727046835.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010574.binac52e7c133b4868de51f64fd94bdc8fd375b5b232b61de938c0f7ac818f6d24e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10574 | 4708 bytes |
font_01_sfnt_off000115c2.bin3c67f774414435ea133e8effda195cf6e9cc1b5d8c33e955741fa1a07cf02965 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x115C2 | 5380 bytes |
font_02_sfnt_off00012829.bin30cbadcdb98af2e8b550f9481d679a2289b04daac0191540a339e6ced18af109 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12829 | 11396 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.