MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URI that directs the user to a suspicious domain, disguised with a search query. This indicates a phishing attempt to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly support the malicious nature of this file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/award?keyword=radioactive+waste+treatment+pdf
- https://xuwogufovesuvem.weebly.com/uploads/1/3/1/4/131406895/vedeparotobepiv_nobamibexut_gulev.pdf
- https://lufojujerap.weebly.com/uploads/1/3/4/4/134481619/jilipa-pizuvupanifo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://roxubimolileko.epizy.com/tibibe.pdf
- https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_9e6066d6c4214388a74be663266c7df0.pdf?index=true
- http://melamodusede.rf.gd/91705630673.pdf
- http://gerodusiwisegog.rf.gd/excused_absence_form.pdf
- https://s3.amazonaws.com/difigomisosak/job_performance_appraisal_templates.pdf
- https://s3.amazonaws.com/kelukakeb/facebook_messenger_apk_por_uptodown.pdf
- https://uploads.strikinglycdn.com/files/710a4cf3-f814-4dd5-ba89-976fae8d4a51/al_quran_al_karim_mushaf.pdf
- https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_892c21d708314ac0be6ac032434f2d83.pdf?index=true
- https://uploads.strikinglycdn.com/files/e668754c-4151-464d-92c4-58f9a77ec2ab/86685506219.pdf
- https://40fd9d30-e691-4ad4-9ff9-7de67b304886.filesusr.com/ugd/45b27a_37c1f052232944d39285538586c16425.pdf?index=true
- http://xukosebufeli.rf.gd/zedibijosagari.pdf
- http://tizoxojuragato.epizy.com/puedo_superarme_bernardo_stamateas_gratis.pdf
- http://xamutakuf.epizy.com/49547151875.pdf
- http://lirolisol.epizy.com/the_very_hungry_caterpillar_full_book.pdf
- https://uploads.strikinglycdn.com/files/ff5614c0-f3a0-427b-877a-4d62a14f962a/how_to_replace_the_handle_on_my_ge_microwave.pdf
- https://s3.amazonaws.com/jemisajoda/business_newsletter_templates_microsoft_word.pdf
- http://zomojafo.epizy.com/vazugunatasafakureviruka.pdf
- http://lumuwejonalar.epizy.com/blood_pressure_measurement_guidelines_2019.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001086e.bin71d5a229eddbfe057e932adade6ed2d08898ac02130f3615935288d6b2ad4f03 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1086E | 5428 bytes |
font_01_sfnt_off00011ae9.bin7d518d3f52f4ba514201ddc9674afeac8ce4174171963dfb21dacd855319575e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AE9 | 11396 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.