MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains references to 'Bts v winter bear mp4' and 'wkhtmltopdf', suggesting a lure for media content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/123?utm_term=bts+v+winter+bear+mp4 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4443608/normal_5ff8d63262d3e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4404528/normal_5ff4b32f71228.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469349/normal_60579e9db2efe.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/fe2767f9-3c91-49d9-bee6-59bfa8cfb37a/sevajivod.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/abde809c-5e53-4c21-b11f-dc83f4090663/6872901653.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6590d9c4-3700-4ab0-9849-a03f4cb77d04/who_made_up_the_3rd_estate_in_france_in_1789.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/055f10be-8316-4318-b97c-46df1da5dd79/hp_designjet_500_printheads_not_functional.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5e42b69-b9d9-40e9-a462-a85044d6577f/1148781206.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/79110510-46f6-4cd4-8fc6-020cffbdb760/94467962042.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/56cb996a-314a-44d4-ae64-5e42b9110484/68791051426.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2af37580-f6f8-42d3-b268-59482d04d60c/xuvatalanakubefop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a39683a4-25ad-45dc-a946-1eff9ea483e3/how_to_take_the_nursing_jurisprudence_exam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4429f38a-e9a6-4276-b08e-772f5d90ba7f/seketuzesutexi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e2e7969-f21f-4f4f-a4cf-2d0a365e2191/lord_of_the_flies_study_guide_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3561f953-3d0e-493b-a230-39c3537cc7b2/python_tutorial_w3schools.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b03e2e2-b50b-4a17-9859-46a7ff609795/law_school_confidential.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e55587a0-2cb2-4466-b084-ed442c51fad1/33556070991.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bac4cf44-2093-4985-83fe-4d82b1730e37/2039211430.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dad68250-24f4-400a-9d61-327a9375b1ea/69595465371.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e63c588a-d533-4fb8-b3ff-00e03c26b803/79628313712.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dc73.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDC73 | 3516 bytes |
SHA-256: 198caa07014e4db04ee93852610f83ce7d50861fa39b6d372677e3b12cdb6431 |
|||
font_01_sfnt_off0000e906.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE906 | 5040 bytes |
SHA-256: fdbfd732af8fb81cc0325da2495ff5c9157b65dbc253bf1d1e52ff2c0cb45e65 |
|||
font_02_sfnt_off0000fa08.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA08 | 3176 bytes |
SHA-256: 465ca73762602111eb42ec0885fb5548068e0c86f32f08b1d1521b924846ca12 |
|||
font_03_sfnt_off000106da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106DA | 11144 bytes |
SHA-256: a866a401521fa603e596cc307cd427f04cd9242b68f204df6cc2daad62d4e386 |
|||
font_04_sfnt_off00012cd5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CD5 | 16792 bytes |
SHA-256: 4e0aeeb34d13d05adcefa79e6b804a79b12b0b490a5691b22d5d6846d21d326e |
|||
font_05_sfnt_off0001439a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1439A | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.