MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain associated with phishing or scam content, and the document body, though heavily obfuscated, contains text related to employment, suggesting a lure. No scripts were extracted, but the presence of an external URI is a strong indicator of a phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=how+much+do+starbucks+employees+get+paid+per+hour
- https://cdn.sqhk.co/mepetiruzi/hjgdjhQ/59108243841.pdf
- http://jekeluxuto.mywebcommunity.org/usa_airport_code_list.pdf
- http://fotogodopuxet.iblogger.org/tetujotivofofudikewekifo.pdf
- https://cdn.sqhk.co/jorisuzil/DPpjhjc/super_sonic_the_hedgehog_pictures.pdf
- http://duzusedolatepe.mypressonline.com/baricco_the_game.pdf
- https://cdn.sqhk.co/dapubebireba/br3jgUb/cruise_com_dania_beach_florida_hotels.pdf
- http://jomikifu.medianewsonline.com/principles_of_microeconomics_9th_edition_isbn.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/13b76e9a-629a-4556-b6be-43956e944ce0/hp_probook_6555b_drivers_download.pdf
- https://uploads.strikinglycdn.com/files/09be9ada-4346-47f4-b277-2eac64f92bda/alpha_omega_elite_car_seat_remove_infant_insert.pdf
- https://uploads.strikinglycdn.com/files/d039d13e-443e-4528-aa4e-753e92d7adb1/46227064663.pdf
- https://s3.amazonaws.com/ragejufa/87272130454.pdf
- https://uploads.strikinglycdn.com/files/8d70de47-b94a-4d0a-aad8-6b573b11c885/pelonis_space_heater_instructions.pdf
- https://s3.amazonaws.com/nilafafakem/58711086784.pdf
- http://limufewugewo.rf.gd/add_combo_box_to_access_report.pdf
- https://uploads.strikinglycdn.com/files/f300962a-65f3-4700-b439-b94297027e46/xupevejakiwataketewenape.pdf
- https://s3.amazonaws.com/gowupuzokowuxes/8494069098.pdf
- https://uploads.strikinglycdn.com/files/1a9eef20-ac14-42c9-8853-38495c6ba28e/what_is_bitcoin_for_dummies.pdf
- https://uploads.strikinglycdn.com/files/bbab39b9-9e19-48ef-a154-2a53bcb46cf3/brother_p-touch_pt-h100_mrkmaskin.pdf
- http://bewaxibazo.epizy.com/what_is_the_remote_code_for_a_onn_tv.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001514b.bin357746ac6d9d7e50dcf956b41de05cb7101a2ae9ffccfca943f2cc166ed2a4cb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1514B | 5848 bytes |
font_01_sfnt_off00016518.bin70d85ebe73cd53b41494b8c596c2a6bc37354cb7b3520f1ec8dbbb5cd8cfcb20 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16518 | 12072 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.