MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a URL that mimics a download link for cracked software, indicated by the heuristic 'PDF_URI' and the URL itself. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution. No scripts were extracted, but the presence of a malicious URL and the document's deceptive content point to a social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://philabc.ru/pbw?utm_term=free+download+autocad+2007+full+version+software+with+crack PDF link annotation
- https://cdn-cms.f-static.net/uploads/4465949/normal_605f8fffeffd0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449603/normal_60630828d2aab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382621/normal_6021cc004318e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4467038/normal_5feb380234187.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407314/normal_5fe2856a2fc34.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417129/normal_6062fa14d5d1a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490752/normal_6037ae58cc2ba.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4469143/normal_5ff9b7afdbc17.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6a8be85c-feff-4279-a9d7-c1bfa9ef94c1/road_trip_pays_basque_france_espagne.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/679c3218-81f8-48c3-ad4a-f0b3c8301c5e/fixopobodegolenixajab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aa4df098-0dbd-43e9-80f8-068a8108b4be/flvs_economics_module_6_exam_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/157920a8-901c-4b62-a490-6574d6c8e1ef/potassium_perchlorate_acid_or_base.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0160979d-0651-46c9-8fac-0364e752c5c4/the_taming_of_ofthe_shrew_act_1_scene_1_study_guide_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/459d7fda-0fd8-422c-8732-f60791c31213/vovokorewo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c1bc43b-6a2b-4230-ab38-2077178e2597/cloud_native_application_reference_architecture.pdfIn PDF document text
- http://wukexav.pbworks.com/w/file/fetch/144838797/30706532236.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7b3473b-1a36-4082-bb56-f1e766a59807/kutem.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b0872df-729b-4d13-a871-791b69f23bec/how_much_can_a_2015_toyota_camry_tow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e5b0710-2a64-4ae3-9a9c-793e210305df/32872456639.pdfIn PDF document text
- http://garewewaziwu.pbworks.com/w/file/fetch/144551847/powuwaxopujekegot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72ee5fcd-05db-4376-b059-f0682aacebec/19224806988.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/862a6130-28d6-4fbc-b21c-51e2f72bdb1c/59577821335.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7983d3e9-0b43-4308-a85f-2e465f45713d/37256080320.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e2a4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE2A4 | 5636 bytes |
SHA-256: 0f6d6cfa50ddca2044f11810c8f9a79b6883f4a698577df0e290e9134e2c26a3 |
|||
font_01_sfnt_off0000f5e7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5E7 | 10928 bytes |
SHA-256: 370df3e7d5b4c3aaa92acdb0c37584983109e3698694d3a03cab9cdeb1cebb24 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.