MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xezojetit.ru/award?keyword=bergson+time+and+free+will+pdf', suggesting a phishing or malware delivery lure disguised as a search result. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a malicious document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/award?keyword=bergson+time+and+free+will+pdf
- http://naturelofo.mypressonline.com/vulujodixejuzak.pdf
- https://cdn.sqhk.co/ruwonumatag/Bgckbih/among_us_sabotage_sound_mp3.pdf
- https://cdn.sqhk.co/verinomo/hboDjcb/bajaj_allianz_general_insurance_health_policy.pdf
- https://vumorusumanipav.weebly.com/uploads/1/3/4/2/134234742/2056635.pdf
- https://cdn.sqhk.co/tajiwikiter/aH3heib/blazetv_promo_code_free_speech.pdf
- https://cdn.sqhk.co/novimabe/ZjfqJVr/scratch_for_ubuntu.pdf
- https://lufosafol.weebly.com/uploads/1/3/0/7/130775677/jifevem.pdf
- http://wotukujis.sportsontheweb.net/lizafewib.pdf
- https://pafudufuwod.weebly.com/uploads/1/3/4/3/134326080/6566717.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/woneketelak/95941446425.pdf
- https://uploads.strikinglycdn.com/files/bd6bfa3e-dd68-4a8d-8d78-4d625879b5a8/7126194754.pdf
- https://uploads.strikinglycdn.com/files/110f4456-15d8-4cc9-830c-aa9751d0f644/watts_premier_ril-10.pdf
- https://fd7a53fe-11c1-4e60-83ad-ac1bb997268f.filesusr.com/ugd/5cf23b_e60be6f4512048cf81cf70778946afb8.pdf?index=true
- https://uploads.strikinglycdn.com/files/fd126fb5-0bf6-45ae-9c69-487120f83db8/16009303386.pdf
- https://s3.amazonaws.com/rizijubovapuk/where_did_abstract_mathematics_originate.pdf
- https://s3.amazonaws.com/vuraradaso/project_igi_2_apunkagames.pdf
- https://d89a15f7-21b5-45f0-b9b4-bc5b7be68842.filesusr.com/ugd/18e821_958afb1ab1c649cab8407864c92333f9.pdf?index=true
- https://uploads.strikinglycdn.com/files/d3b4f5e6-2e38-4747-9d22-f26605ceb22c/insinkerator_badger_500_not_working.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002636a.bin37b8e8d8749ae4ccf3dd0918ed1dfc812321401e4845eab84cecd4560c968e61 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2636A | 5504 bytes |
font_01_sfnt_off00027623.bin950eddc2faae9f28e26577887bb573d0429687729377abc17aa511871865ef53 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x27623 | 10896 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.