MALICIOUS
286
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains an embedded JavaScript payload, detected by ClamAV as Pdf.Phishing.Trojan-d2568dad23a94d95. The embedded script likely attempts to download and execute a second-stage payload from one of the numerous external URLs found within the document. The presence of 'powershell.pdf' in the document text and the ML classifier's high confidence further support a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/strik?utm_term=2001+mitsubishi+eclipse+transmission+fluid+type PDF link annotation
- https://cdn.sqhk.co/xupumekejaxa/iXhdtDY/marvel_realm_of_champions_beta_country.pdfIn PDF document text
- http://tetoxukipim.getenjoyment.net/45232562011.pdfIn macro / runtime command snippet
- http://wei-nmvc.com/mokirizenukozgers.pdfIn macro / runtime command snippet
- http://skameyki.club/69211739959e8az9.pdfIn PDF document text
- http://axecheat8.xyz/charge_dipole_interaction3lb55.pdfIn PDF document text
- https://cdn.sqhk.co/wodelaganav/hebiigg/wear_os_spotify_apk.pdfIn PDF document text
- http://rebezun.mygamesonline.org/mowenavepefo.pdfIn PDF document text
- http://bovibuvebus.getenjoyment.net/kepopilurugel.pdfIn PDF document text
- http://raifaisentgo.online/12045261848cy33i.pdfIn PDF document text
- http://henrysavbr.site/118492988702wi6d.pdfIn PDF document text
- http://kuliwegi.sportsontheweb.net/bovufexivo.pdfIn PDF document text
- http://remastacer.com/the_cancer_journals_audre_lorde_sparknotesjvu3u.pdfIn PDF document text
- https://cdn.sqhk.co/sovanoniwuva/dJjagcn/adolf_hitler_soundboard_download_free.pdfIn PDF document text
- https://cdn.sqhk.co/xupumekejaxa/iXhdtDY/marvIn macro / runtime command snippet
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b1255231-446e-49cf-8c17-c588d3a6eab3/text_file_to_html_powershell.pdfIn PDF document text
- https://s3.amazonaws.com/vazisi/ximusularoz.pdfIn PDF document text
- https://s3.amazonaws.com/tomaxade/lavepafuv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3094ae0c-9aee-4231-8664-297daf458603/5_languages_of_apology_test.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30d4db12-f914-485a-8885-4334153246fc/44514767227.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cbfa9b9c-11c9-48bd-942d-fdd0537ed68b/what_colors_do_psychologically.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_pdf_script_00008ef8.bin |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x8EF8 | 76817 bytes |
SHA-256: 55b497ddabcc6f37e364ede48d93c46bad6eab6fcfe5c2aad8647e060020a701 |
|||
|
Detection
ClamAV:
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload:
likely
Carved artifact contains 1 shell/COM execution token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.4
1 0 obj
<<
/Title (�� 2 0 0 1 m i t s u b i s h i e c l i p s e t r a n s m i s s i o n f l u i d t y p e)
/Creator (�� w k h t m l t o p d f 0 . 1 2 . 5)
/Producer (�� Q t 4 . 8 . 7)
/CreationDate (D:20210317221057+02'00')
>>
endobj
3 0 obj
<<
/Type /ExtGState
/SA true
/SM 0.02
/ca 1.0
/CA 1.0
/AIS false
/SMask /None>>
endobj
4 0 obj
[/Pattern /DeviceRGB]
endobj
6 0 obj
<<
/Type /XObject
/Subtype /Image
/Width 625
/Height 155
/BitsPerComponent 8
/ColorSpace /DeviceRGB
/Length 7 0 R
/Filter /DCTDecode
>>
stream
���� JFIF K K �� C
�� C �� � q " ��
�� � } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�� � w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ? ���ׄ ���ƫ���/ev� ��-�V 1�9�<֔� |? ����ʭĄc��n��"�9~ i�Ta�
�?|njv� � ӴlB� � @�� ��T��e'+�_�� ���� [�4���$�i $���}9��5���8��f$�&�W��5�0U�� �0 >�ZL&� P�{ q�� �3�I ����G6� |81!�C2�M)�鼜t�֑� �h� ��� k�r}������� y ?>ӐYr˸���E<B��R�l �߱�� �fJ��� _��6� �8�d���/�d�m�8� �z4� ���2��9����Pr =��{zu��C�H��A�;~�� ~ �I�P� ���H�w����N�9 � ��&���9 u. -���J �� N�N_�� �U =7c��J��R�W/���/ӓ�}i
���� 7� � �s�� �-���o�9�~ xhr, ��n$�n�
����� �йm<Ƙ �Jz���ӧ {�L.|��hh��� FGqۯ�R��Eʞ\d�����n��2�,�x���� �9��oÒ9c��A� J ���f�� ���I�b2A?j� q�� �&�Y�͗ 1����z q���CJ�.쌯/۷�۞ؤ�m�S� �9��A�� g��EĿ. O��}i�� ��#�%�I?( �2;dn������
��d ��N�q� �=3ӽI��>�K �� �LI���� L���'��S�(l� ���.2>n= �No�^ g�O' ��|�b�)'����C�+0V. Q��z �XÖV ���'��q��� ^�-�J_ ���� � �lx-�y1���ӟ�����E�dy$�b��17 ���\�=��u��ŵI*� �<�3� � �a�ۆ�.x� � �B�>g���� ���7�
]������ ��^GN�� �$ �>�O�iVr9Y���� ���%\q� ���� ��)'�b2O�� ��=� : ����� 3�_�~ [�a� ʔ�A�sٲ:ҟ�� uU�$!�� I���{�] H�r �l � ���� ҅r8�\m �㎽?N��Z�֗��9��S~ E ����.e� �w �!�?� ���� ��ɸ O�� q�WF�e ��l��>��'� w��hVc$�� ��Pr� 99�����NĹ���� �S�O�> ����ņ �Ҁݿ���~ �~ xn4 �� � 4�� �ݟ_�) �@ � �8��z��t��9g݀ m� �� 8�֒C��J?ׯS�o� dFm0�L�y� z}�� ��8D�;�ҏ� �wu i�-��㷧��� +�UT+� �8�ǵ*���v� �c�� /Úd�w���� �|"�����Sa yYF{cv? �� 1 m0&���K�� �}k�*����]�l �;{ "� 8
� �� ,J��� ��z ��C��]Pi� _�3���[�� &���È���� �\�3Ԝ|���]8 K %���d{c�=���Jh>b�.2 _ (�1� �<R4���� � Zt9����` �� � �<�黟��� ¨�����ʤ� �� z��`��k� �����\ � <� 7e� �'�2{�(� ����9��S� � :` 0�lҎ��.�? O�G� r�N`�ci�_�� �������K(2 F:�z�ǧ�=j!� f&1� ��éϹ�)�C���r_�� uli�% � �FpF~� )O��
��6 |�q�?�� ��K VL� ��F8^�;��Ҝ`US�$��}:c>⋥�(��� 3��� �g�#i� �v�� =3���}��>
h � la�� |�m�G�翧Z錋�y���2Iϧ��V'+�, �` � {� >=� Z7v� ���9��C��GO�� ���& @��}?/�0� ��fۧ� rO�) ��?�k�vY�_� p�2�z�_�ғ�Yv�� gGP �r O�"��r��W�����vO�^ �1:z�&B��I���o��Q��?
� gN_� ��R OO�u��_�P\�N� v8?��E�úE�_�' {q���&ީ� _��ߝ �>�*������i�'�0w}q�q �)�7+i?{� <�9 >�q����2� ,� < �?����h��Čq�] lv��t�� �$���{ ��)� F>]=� �'�#���ޙ�8| ��lq���I?��=� 7 k�X���P8f�`0�r Ǧz��� � � ;�R ��篽; ��k�~��s��φ̍�<�p3��Ao���4����j�_LL���6BH�P ���ں �
` 1�͜��F;���9�|b���� �� v1���{Qn�R�|������m� �o`'N%@$�>N}�jA��ÒD�t� �,��� �Ƿ�ֺf;�.}1Ў�� �G~���� ����I"�-t�� _��5 �� �]�q� �� ���ҧ�O ���d
�H?M��� ��O �1�(�@������� ,�e �m%v�9�88� ���+5 ��� V9 �T~ �Dmf��
��1��8;���8�*S���w� g�-�Ը� � ~: �EtE�B@c�H<
������ �+�� wr=� ����FR^�ש�� £������C �K��##w��~ xv F6
� �"�Q�� 7=� /�t C�UC P0X.�� x���G� ��"1vXԖ;�����G<��ir��RWM���/�S���/��E�L$3 �L �� �� ��Iỉ ���U��n% � ̓�~��#���'�T#�;�?� �C m��^� ����� M� �J�_���\��3���F�����|�p{��֛7� ]�:n r���K ` � �R���q� c�����yg C T}�:�<㎇ =)�M?G� ��ם_�> &���3ʹ'����� \|&��)S�!X�v�� q�����?�t� <�J�ݸ`G?_�v�,� �36FQ A��� aBW 9$�v���� �Χ�� o �x��� �l������� �T*�0�x��%# ��߷?�J����X����=�S�2� �� ��֓ �� ���t9u�?���q��2�� =N7� �� �:b 4��`1i�*Tu ��������l� cufCؒ ~�� 9��� h T�� ܜ�z �� ��&���� W��r�� �1 !� ���� Td���֕~
xj �4�Ɍ�� =:��]3*�[ �� A� �� Z� B�~���)POr � o� Z� Ü��A��@�@ Љ��>�{�星 <4ŌZlM�I���#�
... (truncated)
|
|||
font_00_sfnt_off0000e741.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE741 | 5868 bytes |
SHA-256: ca7c2b7a29eb83a6f0f8afac9b1b05e79b96d9ca466aef094f296a494dedc6de |
|||
font_01_sfnt_off0000fb15.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB15 | 10412 bytes |
SHA-256: 1ef30247f9b023df516317296808155ea82e0af008fb25884c9d3b071be4c325 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.