MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document flagged by ClamAV as a phishing trojan. It contains an embedded URI pointing to 'https://jottigo.ru/award?keyword=ganesh+atharvashirsha+pdf+gujarati', which is likely a phishing lure or a distribution point for further malicious content. The ML classifier also indicated a high probability of maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.6922
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/award?keyword=ganesh+atharvashirsha+pdf+gujarati
- http://rezotu.xyz/modern_poetry_books_like_milk_and_honeyg8t4q.pdf
- https://cdn.sqhk.co/zuxafopagad/Laie6yl/48274739589.pdf
- http://plafond.xyz/ejercicios_con_numeros_primos_y_compuestosrpc70.pdf
- https://cdn-cms.f-static.net/uploads/4388283/normal_60567485685c7.pdf
- https://cdn-cms.f-static.net/uploads/4487432/normal_605af83819112.pdf
- http://tehnopolis.org/how_to_give_yourself_a_love_tarot_reading3xdze.pdf
- https://cdn-cms.f-static.net/uploads/4409421/normal_602680687985c.pdf
- http://detonic-shop.website/wirilajetotugufobebixorijw5f3f.pdf
- https://static.s123-cdn-static.com/uploads/4491946/normal_5ff87f12d8335.pdf
- https://cdn.sqhk.co/rudugebakivo/iahfjaX/gangstar_city_game_download_apkpure.pdf
- http://price-list.moscow/85375816890o5jc2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.indictrans.org
- https://uploads.strikinglycdn.com/files/98f44cbe-cd49-40a8-b644-92a57a254491/fuxapojazisivokali.pdf
- https://s3.amazonaws.com/zodawanuror/rufuxulon.pdf
- https://uploads.strikinglycdn.com/files/e32bbfbc-4ea9-4348-82cc-b587e0331166/bakery_business_plan_sample_in_nigeria.pdf
- https://uploads.strikinglycdn.com/files/16931df2-189b-4398-b5f1-82b1bba4fdad/how_much_are_air_force_1_at_foot_locker.pdf
- https://f621ecf8-e26c-4db3-9bdf-176eeceb312d.filesusr.com/ugd/b3755e_38ae1a8c477e4894afc2fc198ced9370.pdf?index=true
- https://69a7f268-727d-4112-ba4f-a3538cc856be.filesusr.com/ugd/9a0d60_24ca95139082442cbf534921bf872ea9.pdf?index=true
- https://uploads.strikinglycdn.com/files/789d310e-b94b-4b61-9394-3e513bb31b10/nufimefadizanuduwodiwesat.pdf
- https://s3.amazonaws.com/pevarijidasalop/is_arris_sb6141_compatible_with_xfinity.pdf
- https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_260415d4b06a4a9aaec8e941f23f96cb.pdf?index=true
- https://712e085e-8422-4094-ae2e-709d430f1fc9.filesusr.com/ugd/bf8edb_2dd65947a6f54035aadc91d4e3b3db7e.pdf?index=true
- https://s3.amazonaws.com/tutapaxi/edge_browser_for_windows_7_filehippo.pdf
- https://s3.amazonaws.com/povelenavuviw/vector_jigsaw_puzzle_template.pdf
- https://6d1a2d78-ebd2-4140-94a0-411197be5b5f.filesusr.com/ugd/88ff89_d493e85bd13243c3b6737071c0896214.pdf?index=true
- https://s3.amazonaws.com/jejulurowev/best_rb_ballads_of_the_2000s.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec23.bind88dabe9cbf26d25e3b29b34c398addf48f8cf0c1210bab9aa3b1e6ac51e9952 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC23 | 5440 bytes |
font_01_sfnt_off0000feaf.bin7f3b76f73377885dde258c792ec7c4c54b22785dfa1d0bcfe5ad1d03e970bea6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFEAF | 16004 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.