MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9950
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/123?utm_term=latest+adobe+flash+player+for+opera PDF link annotation
- http://kutatit.getenjoyment.net/how_hard_is_it_to_set_up_a_wordpress_website.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500895/normal_60243bd87301d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392867/normal_6035aaa314c7d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417312/normal_6002c3af22afa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371523/normal_5febd77dc4813.pdfIn PDF document text
- http://mosuxuvemuzuwex.mywebcommunity.org/tepurimowo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/jeromopelurab/microsoft_chess_titans_for_windows_10.pdfIn PDF document text
- https://s3.amazonaws.com/puretulenuza/fenns_treasure_chest_found.pdfIn PDF document text
- https://s3.amazonaws.com/jenisozazewubo/59366986952.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f938a708-55f6-4f3c-8b07-75de2e9a085f/call_of_duty_cold_war_patch_notes_treyarch.pdfIn PDF document text
- https://s3.amazonaws.com/wikurixobelu/zuturibidojazipipivud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/892ddfa3-0993-403c-95a3-19880164709c/kefaranorajaw.pdfIn PDF document text
- https://s3.amazonaws.com/tuxenipup/led_zeppelin_houses_of_the_holy_album_cover_art.pdfIn PDF document text
- https://s3.amazonaws.com/penale/27902109314.pdfIn PDF document text
- https://s3.amazonaws.com/gebukil/who_is_the_youngest_climate_activist.pdfIn PDF document text
- https://s3.amazonaws.com/gifojuxaxeva/xudupigujiva.pdfIn PDF document text
- http://refusunono.onlinewebshop.net/the_fifth_wave_movie_reviews.pdfIn PDF document text
- https://s3.amazonaws.com/fejakixoweka/ka24de_transmission_name.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8977c972-053f-4bf3-9c7c-a8b1cdf115e8/55079290512.pdfIn PDF document text
- http://peledopa.myartsonline.com/batman_the_killing_joke_download_ita.pdfIn PDF document text
- https://s3.amazonaws.com/salade/61260089262.pdfIn PDF document text
- https://s3.amazonaws.com/zoxewudunigus/el_conde_de_montecristo_resumen_por_capitulos_rincn_del_vago.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e6417eb-b200-45d8-a092-daeab1f84d96/97704574069.pdfIn PDF document text
- https://s3.amazonaws.com/leteraxewe/computer_hardware_tools_examples.pdfIn PDF document text
- https://s3.amazonaws.com/bejexe/crown_xti_2000_amplifier_manual.pdfIn PDF document text
- https://s3.amazonaws.com/lawakux/pawalo.pdfIn PDF document text
- https://s3.amazonaws.com/wolina/minineseruvakilofoxovu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa5d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA5D | 4948 bytes |
SHA-256: 4f2029efa9ddb2df08e8981a5609fe10d0e69d66e5fa7e84c5e0c0ff6e13663f |
|||
font_01_sfnt_off00010b44.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B44 | 11196 bytes |
SHA-256: 1b64db049d8a40adee0bddffc1c123e2b5ad84bb30b90a2b57d36b0af95bd36d |
|||
font_02_sfnt_off00013162.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13162 | 4324 bytes |
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.