MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a site offering a PDF download, which is a common lure for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a legitimate download link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9930
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nomylo.ru/pbw?utm_term=development+across+the+lifespan+9th+edition+pdf+free+download
- https://cdn-cms.f-static.net/uploads/4378171/normal_604daad2861ca.pdf
- https://befukifesili.weebly.com/uploads/1/3/1/4/131453358/xaluwep.pdf
- https://cdn-cms.f-static.net/uploads/4389352/normal_606692ae8bca5.pdf
- https://cdn-cms.f-static.net/uploads/4393641/normal_605d88c2f23aa.pdf
- https://kivomulugan.weebly.com/uploads/1/3/2/6/132695939/9565132.pdf
- https://zoditasus.weebly.com/uploads/1/3/4/6/134670667/8140418.pdf
- https://wofogubegir.weebly.com/uploads/1/3/4/7/134728038/wubakafaniwuwen.pdf
- https://static.s123-cdn-static.com/uploads/4473637/normal_5fc9783ec718b.pdf
- https://cdn-cms.f-static.net/uploads/4415526/normal_5fdb7be39637f.pdf
- https://static.s123-cdn-static.com/uploads/4485443/normal_5fcdc41cc0508.pdf
- https://cdn-cms.f-static.net/uploads/4368996/normal_60484ba816c16.pdf
- https://kixuvatapowow.weebly.com/uploads/1/3/1/3/131383305/kevojetutexetepo.pdf
- https://depesusexufajev.weebly.com/uploads/1/3/5/3/135351117/d194b73.pdf
- https://static.s123-cdn-static.com/uploads/4379387/normal_5fdf5992a1611.pdf
- https://sopazamiwurigu.weebly.com/uploads/1/3/4/3/134387891/pivisava.pdf
- https://cdn-cms.f-static.net/uploads/4493600/normal_6015d429aec7f.pdf
- https://cdn-cms.f-static.net/uploads/4487416/normal_600fb48950679.pdf
- https://vakejijumusefuv.weebly.com/uploads/1/3/5/3/135313512/8785524.pdf
- https://cdn-cms.f-static.net/uploads/4481059/normal_605b5a3ff3373.pdf
- https://cdn-cms.f-static.net/uploads/4455670/normal_602ef7a29490c.pdf
- https://nolipugi.weebly.com/uploads/1/3/4/6/134652161/jevilekesudaned.pdf
- https://cdn-cms.f-static.net/uploads/4382421/normal_606b64b5d21c1.pdf
- https://guvisine.weebly.com/uploads/1/3/4/5/134598756/4475476.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/6d0884e2-1791-419f-b6a0-4327c241b59a/how_to_get_robux_for_free_in_2021_free_robux_promo_codes_roblox.pdf
- https://uploads.strikinglycdn.com/files/8390c7c1-22f2-4022-8c1e-7cc4ba27625a/attack_on_titan_manga_chapter_release_dates.pdf
- https://uploads.strikinglycdn.com/files/71a37928-9f68-4872-9518-0c351bb357ef/how_do_i_get_a_replacement_safeway_club_card.pdf
- https://uploads.strikinglycdn.com/files/1a8bd458-e56e-4def-a168-3a9e94bd9b1b/fikoxavu.pdf
- https://uploads.strikinglycdn.com/files/75311d76-13c2-43b2-b8b5-16debba52c2b/kijimubileguxajenofu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000207c7.bin534ea3a9439af28f539f70c385ecf52d30500433728336700cb45c38c7aa777d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x207C7 | 5488 bytes |
font_01_sfnt_off00021a54.bine37a1b59925324a1b020d7236cf15f1ee856d3580bda61eee3f5cdce8c087592 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x21A54 | 11828 bytes |
font_02_sfnt_off000241b5.binff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x241B5 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.