MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1059 Command and Scripting Interpreter
T1566.001 Spearphishing Attachment
The PDF contains a heuristic indicating a clipboard command execution lure, instructing the user to copy and paste content into a shell. This, combined with the ML classifier and ClamAV detection, strongly suggests a malicious intent to trick the user into executing commands. The embedded URL points to a suspicious domain, likely part of the attack chain.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/award?keyword=analyzing+likert+scale+data+pdf
- https://cdn-cms.f-static.net/uploads/4403556/normal_5fd2cf61cca87.pdf
- https://cdn-cms.f-static.net/uploads/4495043/normal_604136442f40d.pdf
- http://rajeziriga.scienceontheweb.net/new_catholic_mass_responses_in_tamil.pdf
- https://cdn.sqhk.co/mujekesire/5MPNjck/hex_wars_2.pdf
- https://cdn-cms.f-static.net/uploads/4453730/normal_60171aacbc1df.pdf
- http://rameautbxy.space/60852692651fv97m.pdf
- https://cdn.sqhk.co/puvijupem/wKggqYH/ark_survival_evolved_xbox_one_size.pdf
- http://fijubigatusurov.scienceontheweb.net/kukurepomomosolabexave.pdf
- https://cdn-cms.f-static.net/uploads/4405904/normal_5fd8768c40f36.pdf
- https://cdn-cms.f-static.net/uploads/4415526/normal_602788e7e35bd.pdf
- https://cdn.sqhk.co/rikopekela/9jjqzRg/rowilizagidibu.pdf
- http://findssldz.xyz/juganodpvm81.pdf
- https://cdn-cms.f-static.net/uploads/4402014/normal_60344cc1b3772.pdf
- https://cdn-cms.f-static.net/uploads/4388283/normal_6066cfea22871.pdf
- https://cdn-cms.f-static.net/uploads/4444371/normal_5fd889528a0a1.pdf
- http://gojovujewinunuj.mygamesonline.org/12241613547.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://duginefasozuna.rf.gd/93521413778.pdf
- http://potubavaziripek.epizy.com/cooking_merit_badge_worksheet_2017.pdf
- http://gozenabuzixi.onlinewebshop.net/wojukimevevowosu.pdf
- http://fofuxolisemaxim.epizy.com/stepper_motor_arduino_datasheet.pdf
- http://laxonuzuw.epizy.com/bogle_book.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e33a.bin7aa2b9b62dfdf5b17db195e6401069d0769b704167e103ef544bb668b480caeb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE33A | 5528 bytes |
font_01_sfnt_off0000f637.binc13c6ed80b65c5cbccc835d36b96539558a70b1860d9c9e89054dfd68c550105 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF637 | 11312 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.