MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://nipisod.ru/wix?keyword=holy+family+festival+nutley+nj` suggests a phishing or redirection attempt, likely to deliver a second-stage payload or lead the user to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URIs are consistent with common phishing lures.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/wix?keyword=holy+family+festival+nutley+nj
- http://fegivate.medianewsonline.com/mifevono.pdf
- http://vusejulene.iblogger.org/beiimaan_love_movie_hd_filmywap.pdf
- http://biomaniix.website/magic_chef_refrigerator_fan_not_workingsk1dq.pdf
- https://porovepo.weebly.com/uploads/1/3/4/5/134527374/guvarinubutidunarisa.pdf
- http://sefesipodaj.22web.org/poe_witch_leveling_guide_3._3.pdf
- http://zotokolumo.iblogger.org/engineering_workshop_materials_list.pdf
- http://presente-top.store/netgear_ac1600_r6250_manual786m4.pdf
- http://meetsalle.xyz/madden_16_ps4_gameplayelgvb.pdf
- http://health2health.online/clothing_donation_boxes_near_meil1x2.pdf
- http://manovina.mypressonline.com/81421429397.pdf
- https://tajerupabud.weebly.com/uploads/1/3/1/1/131164315/boxejaraxaf-legilogawet-xiwaritirutabop-xofizabafedav.pdf
- http://topsalon.xyz/proshop_led_par_64_manualr6nq7.pdf
- https://sawagifavemon.weebly.com/uploads/1/3/0/7/130775832/pamimokebi.pdf
- http://profaudit32.ru/21364751094vgdq9.pdf
- http://present-mag.ru/sewubifibanefs65km.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://sozazavore.rf.gd/friday_night_lights_book_characters_where_are_they_now.pdf
- http://sivopumifivak.epizy.com/kung_fury_not_on_netflix.pdf
- http://lesizuli.epizy.com/download_sound_drivers_for_windows_10_acer.pdf
- http://suzufesa.epizy.com/wireless_charging_pads_for_android_phones.pdf
- http://bologipegokofi.epizy.com/wekuzaxabikatakuzovarigob.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e877.bin92f8e67f36a299cb896bf7c76b03f854b6f3890d1aeeb4a2b8935f67dee93c77 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE877 | 4896 bytes |
font_01_sfnt_off0000f91e.bin907ade1162a29a8554934ba7ce5be85cf37c1a4073feb1bb7d916fb620d1141e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF91E | 12472 bytes |
font_02_sfnt_off000122c3.bin7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x122C3 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.