MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'nipisod.ru', which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily corrupted, suggests a lure related to educational content, aligning with common phishing tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/wix?keyword=go+math+5th+grade+chapter+11+extra+practice
- https://cdn.sqhk.co/kuwusemob/Cnjdbf2/international_marketing_notes.pdf
- https://cdn-cms.f-static.net/uploads/4494868/normal_60283ba6ab4f6.pdf
- https://cdn-cms.f-static.net/uploads/4446034/normal_602ea6a71ece5.pdf
- https://cdn.sqhk.co/kesufetumo/hePkiil/juego_de_drones_para_android.pdf
- https://cdn.sqhk.co/lotivadafe/EK8jihi/86200267644.pdf
- http://kuninikulu.iblogger.org/73891206688.pdf
- https://cdn.sqhk.co/febowozefu/hhgdTge/revuvizabudusupezipabobuj.pdf
- https://static.s123-cdn-static.com/uploads/4417830/normal_5fe4530bd8ef8.pdf
- https://cdn.sqhk.co/miburixegapu/jcihijf/roblox_games_to_play_online.pdf
- https://cdn.sqhk.co/bezofusipow/kicgdOa/god_of_war_battle_theme.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://dofomexikokubeb.epizy.com/cobra_29_ltd_classic_cb_tricks.pdf
- https://s3.amazonaws.com/zoromexemuzid/add_and_subtract_fractions_with_unlike_denominators_activities.pdf
- http://kenasaxoxaxober.rf.gd/unix_commands_for_hadoop.pdf
- https://s3.amazonaws.com/nademopor/tuzamu.pdf
- https://s3.amazonaws.com/wazorixekunafob/68376540904.pdf
- http://mabuxet.epizy.com/bade_bhai_sahab_premchand.pdf
- http://pivewumo.epizy.com/azar_app_free_for_pc.pdf
- https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_8770fd9d0e254898bfb781253b7ed912.pdf?index=true
- https://6f465708-eb37-4ee2-8658-ebeec6cd93ea.filesusr.com/ugd/4bb103_cdcde160a8e24e4b9da1c1159b3976cb.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e18a.bin6ba954023faadce025b49e6b798a4c857d6b08c0ea26d50480b35508267c72a4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE18A | 5552 bytes |
font_01_sfnt_off0000f44f.bin8e45bb50ce6e02f90347022e98d29ac17696efaf8b1cdf55e097d362192d1234 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF44F | 10108 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.