MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains multiple embedded URLs, with the primary one being 'https://golowaki.ru/123?utm_term=htn+guidelines+2019+pdf', suggesting a phishing attempt disguised as a document. The document body, though heavily obfuscated, appears to contain metadata related to guidelines and the wkhtmltopdf tool, further supporting the lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/123?utm_term=htn+guidelines+2019+pdf
- https://bativazuwa.weebly.com/uploads/1/3/0/9/130969541/4ab979034cab92.pdf
- https://ferofetilusef.weebly.com/uploads/1/3/5/3/135346026/1790573.pdf
- http://goods-amzon.com/how_to_adjust_brightness_on_ti_84_plus_ce0ljal.pdf
- http://capridigi.com/wabavamajelifovb1h3x.pdf
- http://cuzinfo.ru/85423795416virsa.pdf
- https://zudupati.weebly.com/uploads/1/3/1/8/131856533/7522114.pdf
- http://jarowulizose.sportsontheweb.net/81256372893.pdf
- http://judijemavup.22web.org/attract_woman.pdf
- https://tofudilasikota.weebly.com/uploads/1/3/0/9/130969343/zubikupak.pdf
- https://zozolesib.weebly.com/uploads/1/3/4/6/134631165/zitolis.pdf
- https://static.s123-cdn-static.com/uploads/4391047/normal_5fefb290a8086.pdf
- http://nat-yoga.space/rafuneremiboz892u.pdf
- https://static.s123-cdn-static.com/uploads/4466996/normal_60048489edee1.pdf
- http://tasiperop.medianewsonline.com/how_to_echo_test.pdf
- http://bixesifebara.iblogger.org/how_to_put_a_400_day_clock_in_beat.pdf
- http://pazujiz.mygamesonline.org/224_valkyrie_best_powder.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/sabobenuwe/faustformel_bremsweg_bei_100_km_h.pdf
- https://s3.amazonaws.com/taguxif/elder_scrolls_online_classes_guide_2019.pdf
- https://s3.amazonaws.com/latufenaw/phpstorm_reformat_code_in_directory.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dadb.bin0d767379e97e04ad1a26f498833a841e141caa3342f8dd6b2f2ac6c140c7ca10 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDADB | 5348 bytes |
font_01_sfnt_off0000ed30.bin32a97051b655a5e1ed7d002b244c1f3dd4609f904b73f4b1242ae9b3f6f75775 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED30 | 10436 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.