MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://dafemum.ru/wix?keyword=castle+clash+mod+apk+ios` suggests a phishing or malware distribution lure, likely attempting to trick users into downloading software. The PDF structure and embedded URI heuristic further support the classification as a malicious document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/wix?keyword=castle+clash+mod+apk+ios
- http://reduslim-ufficiale.website/burger_king_gutscheine_oktoberf87tk.pdf
- https://cdn.sqhk.co/zolokike/lij0Nhc/movistar_plus_apk_android.pdf
- http://podipotekoi.ru/sozokuvewawetelezatapesjnt4o.pdf
- http://trastenmyqort.online/aspen_colorado_court_reporterdmcpw.pdf
- http://p-kavkaza.ru/milton_bradley_electronic_battleship_instruction_manual3fap4.pdf
- https://cdn.sqhk.co/daborofus/ij9ojem/wufofedopisalafududixifid.pdf
- http://dmdmassage.com/pobazuposawr2n81.pdf
- http://grenkasalo4.xyz/gefujesepabimozf3x00.pdf
- http://serviceforyou.site/how_to_become_more_self_disciplined_like_in_the_militarytmy3z.pdf
- http://life50it.pro/damovedirepogagu5ks2q.pdf
- https://cdn.sqhk.co/dejegekonula/cGj8iju/mikofajabikivu.pdf
- http://hallhq.xyz/48984339592km6wv.pdf
- http://blekrossi.ru/what_is_the_healthiest_meal_at_chick_fil_ajvlzn.pdf
- http://senteber.site/vatagewetodotelakajiveri7wp38.pdf
- https://cdn.sqhk.co/pevejotomoma/hbLgYIc/sonic_adventure_3ds_port.pdf
- https://cdn.sqhk.co/wudajelu/dWidZgt/30528312348.pdf
- http://instahelpforbusiness.com/negibmnrj1.pdf
- http://virona.org/38132579163jtc8r.pdf
- https://cdn.sqhk.co/ruwuwedelo/a3B6frX/silver_dollar_city_christmas_tree_videos.pdf
- http://my-favshopc.online/dodge_ram_1500_parts_canadali7en.pdf
- https://cdn.sqhk.co/letinumi/XhbRjfN/ice_cream_van_song_south_africa.pdf
- https://cdn.sqhk.co/walumupo/jdVJp7M/36001745314.pdf
- https://cdn.sqhk.co/nububufi/WYrgcgh/stickman_legends_shadow_wars_apk_mod_atualizado.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d9e4.bin31401a97820240802f10ba2ec155efe402ed63e1daa32b656655f7eeaeee05bc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD9E4 | 5188 bytes |
font_01_sfnt_off0000eb5b.bin984d87b7c179040cf8d9889bf94319d7ff05886a9fc1cc10fb1ffabbe6676d89 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB5B | 10572 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.