MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that mimics a search engine result, likely to trick users into visiting a malicious site. ClamAV and ML classifiers strongly indicate malicious content, and the PDF structure includes external URI references. No scripts were extracted, but the overall pattern suggests a phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://wastran.ru/pbw?utm_term=what+is+the+meaning+of+platypelloid+pelvis
- https://cdn-cms.f-static.net/uploads/4383801/normal_6058ccb6a99db.pdf
- https://cdn-cms.f-static.net/uploads/4384155/normal_60615c916ce38.pdf
- https://static.s123-cdn-static.com/uploads/4366020/normal_5fc810cdc90b4.pdf
- https://static.s123-cdn-static.com/uploads/4449395/normal_5fc985382abe5.pdf
- https://cdn-cms.f-static.net/uploads/4443325/normal_60588a5b2b14a.pdf
- https://cdn-cms.f-static.net/uploads/4413454/normal_6063df7e5de87.pdf
- https://cdn-cms.f-static.net/uploads/4390323/normal_601b10c347948.pdf
- https://cdn-cms.f-static.net/uploads/4445877/normal_604b21f33cdb4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/37a336bf-3b9e-4d98-b915-9a2ed1612808/gujinadavojixof.pdf
- https://uploads.strikinglycdn.com/files/d52e4eb6-77ab-4c1b-8824-261ffa52097f/dugikevulod.pdf
- http://xetibubib.pbworks.com/w/file/fetch/144418017/how_to_pass_minnesota_road_test.pdf
- http://nusuwoxub.pbworks.com/w/file/fetch/144427152/how_do_you_reset_a_honeywell_home_thermostat.pdf
- https://uploads.strikinglycdn.com/files/dcc05434-7873-4a31-a2a3-9006505b0d20/the_language_of_god_chapter_summary.pdf
- https://uploads.strikinglycdn.com/files/bdd51ddd-0a09-463f-99a1-fdcbba3fecba/free_sewing_patterns_for_womens_shirts.pdf
- https://uploads.strikinglycdn.com/files/5b14ff30-a1a3-4fe9-add5-440088f16da8/38233769447.pdf
- https://uploads.strikinglycdn.com/files/43807114-1f30-4bea-96a4-132c24c91b25/73417104499.pdf
- https://uploads.strikinglycdn.com/files/03c75d49-e99c-4435-b701-fb724063cb45/what_is_a_yamaha_clavinova_piano_worth.pdf
- https://uploads.strikinglycdn.com/files/f2efe415-a25f-404d-b080-d132eab2d125/43716843192.pdf
- https://uploads.strikinglycdn.com/files/fb9e5d0c-ef43-4242-a8fb-3fe4358e3037/hp_folio_9470m_elitebook_price.pdf
- https://uploads.strikinglycdn.com/files/f69b1596-168c-4405-b657-85df29735ba6/88797226006.pdf
- https://uploads.strikinglycdn.com/files/eae35b03-6e6d-46be-ba2f-7660ab8f3dfc/47321220059.pdf
- https://uploads.strikinglycdn.com/files/736c5832-4c5f-4416-9306-4b585cf1d002/pepikoroxazukibudo.pdf
- https://uploads.strikinglycdn.com/files/ce1deecb-503a-42dd-9151-d54f377aeb30/grille_salariale_convention_66.pdf
- https://uploads.strikinglycdn.com/files/7279afea-d559-4d3b-9057-f9bbc30274f3/should_i_use_shopify_or_wix.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f773.bind050a7f5e67882084bfa80467c753624e1f69e2cac69485f30f506afc5eeb710 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF773 | 5532 bytes |
font_01_sfnt_off00010a3c.bin1157ea5ac748439cc07ceffb61f746cc0a34d07335c1cdd3634c10cd908be74c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A3C | 11224 bytes |
font_02_sfnt_off00013018.bin8f6ddafd3b0ce2004b9503adf603897a58143e210ca714e8dcfcba1b249cf112 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13018 | 16080 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.