MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains an embedded URI pointing to a suspicious URL. ClamAV and an ML classifier flagged this PDF as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, appears to reference a Nespresso machine, suggesting a lure to entice users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9956
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/strik?utm_term=nespresso+lattissima+one+by+delonghi+silky+white
- http://ganalozugimak.iblogger.org/nalelakisupufe.pdf
- http://4gusevshop.space/aisi_1020_standardmoo0o.pdf
- https://cdn.sqhk.co/jiguluzufuwa/xgdEFW4/76368706194.pdf
- https://cdn.sqhk.co/texojijoraso/6IhjDHp/19263572849.pdf
- https://cdn.sqhk.co/wuvotalek/KGIicdP/69463045365.pdf
- https://cdn.sqhk.co/rixutixim/f3hhgdo/18300369304.pdf
- https://cdn.sqhk.co/rovifatira/amjilMD/mevedexutaloseri.pdf
- http://krym.today/mathematical_physics_boasusgxv.pdf
- http://itsamorem.com/homedics_sc-531_manualp4kge.pdf
- http://clientbluebadge.com/nunomuvawizelerj97ke.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fadoxom.epizy.com/mapa_de_alagoas.pdf
- http://nenedabex.rf.gd/photography_consent_form_template_word.pdf
- https://uploads.strikinglycdn.com/files/fd6404b5-5c21-4b3d-b53e-5ea21f835009/best_calorie_counter_app_2020_uk.pdf
- https://uploads.strikinglycdn.com/files/14b4eede-1b60-4911-8208-8091f536fc8a/fijidubof.pdf
- https://s3.amazonaws.com/turip/stock_audit_report_format_in_word.pdf
- https://s3.amazonaws.com/sifawekujiki/joburolub.pdf
- http://biguvuxurezuto.epizy.com/fake_caller_id_cracked_apk.pdf
- https://s3.amazonaws.com/rujabepifar/ipod_nano_6th_generation_charging_cable.pdf
- https://s3.amazonaws.com/pukaridimupo/76569735923.pdf
- https://uploads.strikinglycdn.com/files/5e32d989-7861-4745-8932-ff0505bd154d/sitir.pdf
- http://fonimegalidoxu.epizy.com/amaravathi_tamil_hd_full_movie.pdf
- http://lijulipewagikev.rf.gd/filmywap_2019_hollywood_bollywood_movies.pdf
- http://vijekidifo.epizy.com/mejafirunagodixiravuk.pdf
- http://muwiliwus.epizy.com/pefitugidadadokirupu.pdf
- http://lerapavuzuloz.epizy.com/xigebub.pdf
- https://s3.amazonaws.com/genedesowul/tp_link_tc-7610_setup.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e961.bin3ae7639717798a4cb8ac07c4710e153b79e81c3ed8057a155c8fd4cfa78c3ecf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE961 | 5740 bytes |
font_01_sfnt_off0000fcd4.bin9fc533896ffd6cf9725560c430b2e3ff674e13f8d74fda1188db8fe308b1887a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCD4 | 10548 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.