MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=biology+quick+study+guide PDF link annotation
- https://static.s123-cdn-static.com/uploads/4393632/normal_6006d44532c52.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388046/normal_601d0678bc762.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469836/normal_60201afc74eb1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368751/normal_601715a14bcb9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475874/normal_5fdd89034cc34.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476566/normal_6033baf019aea.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418370/normal_60302e02dc380.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489724/normal_603e5a8683133.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451376/normal_6036d8fe724c2.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489050/normal_5fc71e0936423.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4473030/normal_5ff6222a8740d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/08bf8e80-79c2-448e-b041-aa2ea6a00d7a/how_to_wing_chun_dummy.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c29437d-824d-4880-bed9-c6a9eff51a84/psalms_the_prayer_book_of_the_bible_by_dietrich_bonhoeffer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e8fc1920-64c1-40b5-afae-d2e8b6b3cce4/47746484324.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e2424c7-9ad7-4a18-a430-c5522a64a7b9/smoked_brisket_flat_weber_smokey_mountain.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4421f24-66d9-4419-ad61-8fb54504c129/72077110757.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3e44711-a0cf-4b95-bebc-95292cbbd3c7/nubigiladepovemexudidogaf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7fd32b0-6fc6-4223-8d9f-95cdf8a5416c/what_is_the_best_gps_coordinates_app_for_iphone.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ae7cc629-60e8-4ca6-aca1-bc90bd489550/hound_of_the_baskervilles_1983_full_movie_online_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/afcdc4fa-d6e4-4512-aaad-06aa8131298d/gogekapupisitax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3fb275d-1556-443a-8033-f2f8bf759c5c/giraffes_cant_dance_book.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3350bd2b-adc8-4f34-be71-cdeed207a3bf/596815508.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02415e15-f6c1-40df-9104-422d2944428e/how_to_clean_cuisinart_single_serve_coffee_maker.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed41.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED41 | 5144 bytes |
SHA-256: 28cf45ac47b1eb852f7747655ea059cbbf66535a9eb47b633b55c928afd63bce |
|||
font_01_sfnt_off0000fedc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEDC | 10524 bytes |
SHA-256: d06e55168098da65b3f4aed2df3f88c3aec04f37f9388892cd37fb73b385ba7d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.