MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'botokaw.ru', which is likely used to host malicious content or redirect users to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'consumer reports best mattresses 2017'. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=consumer+reports+best+mattresses+2017
- https://cdn.sqhk.co/naxupowu/hdLnWUV/60845798761.pdf
- https://cdn.sqhk.co/kovezozeseg/ibihgjv/join_shoot_clash_3d_hack_mod_apk_download.pdf
- https://cdn.sqhk.co/fevivesuxofo/5VDgigg/buvareximokoxexido.pdf
- https://cdn.sqhk.co/gemukojev/hbIggc5/wozod.pdf
- https://cdn.sqhk.co/bebomopakax/cghjgD2/rileliwotawejevivopufebi.pdf
- https://cdn.sqhk.co/lijuwezasip/kibhghf/stick_run_hack_access_token.pdf
- https://cdn.sqhk.co/wuzufoxo/thgO8ks/skater_skirt_black_plus_size.pdf
- https://cdn.sqhk.co/bekutojeke/hiT5T1L/fifa_world_football_player_ranking_2019.pdf
- https://cdn.sqhk.co/gawisibiw/jcmhabD/sejarisakuzesu.pdf
- https://cdn.sqhk.co/navimoxa/zZOyEji/project_management_certification_costa_rica.pdf
- https://cdn.sqhk.co/nudofarus/icLscid/14660618300.pdf
- http://gomotejux.iblogger.org/zasowimivamulezoninesavo.pdf
- https://cdn.sqhk.co/gisatajofo/idwgdaU/21685371741.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/bejexe/tifigarozetotisokojazemi.pdf
- https://s3.amazonaws.com/xonaxevetaf/6225311064.pdf
- http://sikejilewiz.epizy.com/95081063452.pdf
- https://s3.amazonaws.com/panalipolifod/beginning_english_worksheets.pdf
- http://lalejifidesuwo.rf.gd/22494888964.pdf
- https://s3.amazonaws.com/vuzufexarevima/fozidi.pdf
- https://s3.amazonaws.com/mukutud/14983928823.pdf
- https://s3.amazonaws.com/jidosatikim/complaint_template_form.pdf
- https://s3.amazonaws.com/jejulurowev/destiny_2_attunement_of_grace_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1d2.bin0d84b9d77f5d37aa4e90aff3ef9ba771c4a905b41544a37d24197e188ad63826 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1D2 | 5384 bytes |
font_01_sfnt_off00010405.bin3d2f0aa63afa0258740f39976ce65d8a7744e2f6322f8ef218c4013d1885bb30 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10405 | 11216 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.