MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains an embedded URI pointing to a suspicious domain, 'resalured.ru'. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, suggests a lure related to a 'four stroke cycle worksheet', which is likely a pretext to direct the user to the malicious URL for further exploitation or phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/123?utm_term=four+stroke+cycle+worksheet
- http://wopafopu.22web.org/cakewalk_sonar_full.pdf
- http://olipaka.xyz/74335661040y7nyf.pdf
- http://vkrowl.com/70945789611j7mty.pdf
- http://ruwazumusef.scienceontheweb.net/xuwuwiwinanenuzazotipina.pdf
- http://bebetadiruj.mywebcommunity.org/magolezanisux.pdf
- http://familyit.pro/what_is_a_good_size_pressure_washer_for_home_use2xxwq.pdf
- http://mavitrade.com/android_studio_logcat_dead85elw.pdf
- http://fortuneo.best/dajedosorizina76hwf.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://591e60e9-54e8-4b06-a9a7-f2e0522969d0.filesusr.com/ugd/1fd4b7_bbb3b339666e4ab082c9d36f0f3173e6.pdf?index=true
- http://mexokibalu.epizy.com/golden_book_of_english_for_class_11.pdf
- https://uploads.strikinglycdn.com/files/bdfde007-6f74-41a6-a7b4-7ac8f5e8af03/fidivojewupuradod.pdf
- https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_ac3e25e37adc4619853fc6cc3094a01f.pdf?index=true
- https://4b3b4da4-1145-40fd-8a04-0ac29766dab0.filesusr.com/ugd/6c6203_939ceab687054c4ea4d360bd6894020f.pdf?index=true
- https://s3.amazonaws.com/lodazojamuva/hssc_lab_attendant_answer_key_shift.pdf
- https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_18733c04073c40de98fd23a6dd04373e.pdf?index=true
- https://s3.amazonaws.com/xedewofuretujo/fiwimud.pdf
- http://nufurezoguboli.epizy.com/14942639767.pdf
- https://uploads.strikinglycdn.com/files/70a4f394-58e8-4fb7-b056-7b9c28e31309/10499008682.pdf
- https://s3.amazonaws.com/pexodugosa/what_are_some_keywords_for_description_text_structure.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cdbb.bin9496ff133d81316b09f9f8a1b7d503deeb09240323235cfeaab2bb9226983cc9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCDBB | 4892 bytes |
font_01_sfnt_off0000de7b.bin3b466aab3f25e6c1f609bded560d9bf6b4476257e757a0e8a159b17935c5f9ae |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE7B | 10296 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.