MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that references a popular game, 'Empires and Puzzles', suggesting a social engineering lure. While no scripts were directly extracted, the nature of the detection and the embedded URL indicate a phishing attempt likely designed to lead the user to download further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=empires+and+puzzles+hero+academy
- http://sebekeruxa.iblogger.org/goflex_home_reset.pdf
- http://health-top.ru/78414871370o5rec.pdf
- https://gadebalemalun.weebly.com/uploads/1/3/4/4/134443756/993493.pdf
- http://koolmaxt.online/samurai_sword_fighting_movesmnai5.pdf
- https://saripubisopa.weebly.com/uploads/1/3/5/3/135322362/f75b9d25ff1088.pdf
- http://meetraisins.club/whats_the_best_stock_analysis_softwaree79dj.pdf
- http://vvd.bar/nazusutejaxivezb7cpk.pdf
- https://jurulekoteg.weebly.com/uploads/1/3/4/7/134700509/kasufufiwojopowadu.pdf
- https://dapijapivabug.weebly.com/uploads/1/3/4/3/134338952/fizakuxufulenok_lekiponojuseku_rinuzedewi_sutiziv.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/77bd15ba-daa0-49fa-a7a7-f54081cd29f6/how_to_buy_word_for_mac.pdf
- http://vugugemo.atwebpages.com/92190607712.pdf
- https://uploads.strikinglycdn.com/files/b4b7f532-0934-428e-bba6-e2ffefb79252/how_to_write_a_conclusion_paragraph_7th_grade.pdf
- http://setojiwesurif.epizy.com/smarter_balanced_math_practice_test_4th_grade.pdf
- https://31e93880-45ab-4687-a485-f0c6d7b894e5.filesusr.com/ugd/79e5df_54aedcec51eb456580b0494a5a14b486.pdf?index=true
- http://kolofagigetu.epizy.com/emily_blunt_the_devil_wears_prada_quotes.pdf
- http://tiripetejakiwa.rf.gd/days_of_the_week_esl_worksheet.pdf
- http://kalasoziluxolim.myartsonline.com/types_of_bias_in_statistics.pdf
- https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_a17fcdab94a94d318baf65e244589798.pdf?index=true
- http://davofunup.onlinewebshop.net/24979250879.pdf
- http://fuluputig.epizy.com/albinism_from_genotype_to_phenotype_answer_key.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010b8e.bin1496506c8496688d630a27a4f5354490bf8be94ab49f54fe745945c5e7cf20c8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B8E | 5420 bytes |
font_01_sfnt_off00011dda.binc4fcc3eb6f34b772a21b473cf9fd47f1923757c0fd3fb4374f2e38351a203a6c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11DDA | 12576 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.