MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though heavily obfuscated, appears to be a lure related to school supplies, aiming to trick the user into visiting the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/123?utm_term=school+supply+for+5th+grade PDF link annotation
- https://cdn-cms.f-static.net/uploads/4405208/normal_5f999a4c125d5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4390366/normal_5f995accc76ff.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426279/normal_5fd6647e3b9e0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4494875/normal_5fb937a930a2f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371787/normal_5fbebd2e1b63b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/fonibinaraj/lock_picking_guide.pdfIn PDF document text
- https://s3.amazonaws.com/vovuzize/58522300805.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc4c6e42e537a05ef21e5be/t/5fc510d33c6ccf69f3feecd5/1606750419412/wujedenagebewilukawawu.pdfIn PDF document text
- https://s3.amazonaws.com/poguvelefa/9855350961.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f339dad-b24f-40da-ad7e-24b1f4c80442/bovifawezilevobukif.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f9d9c04-0f37-4fc0-9d3c-3903f247885d/33571353584.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d53b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD53B | 5472 bytes |
SHA-256: 9a43c8302d6e3f4cd09ce04bd40036b6daf485cbabb1aa510f036d3130131cb8 |
|||
font_01_sfnt_off0000e7f2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7F2 | 10308 bytes |
SHA-256: dfd182470aa3bce71db54b7346ec3c97b8e76906c303d2980f4a7301886fc1c1 |
|||
font_02_sfnt_off00010b05.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B05 | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.