MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely as part of a phishing or credential harvesting scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI heuristic suggest an attempt to redirect the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/award?keyword=antituberculosis+drugs+pdf
- https://cdn-cms.f-static.net/uploads/4411245/normal_604cd6513f63b.pdf
- https://cdn-cms.f-static.net/uploads/4456114/normal_60266068329d5.pdf
- https://static.s123-cdn-static.com/uploads/4426423/normal_5fee817ee6fd0.pdf
- https://cdn-cms.f-static.net/uploads/4366384/normal_6055227935948.pdf
- https://cdn.sqhk.co/nufesewepi/lZYjiic/xokivafiged.pdf
- https://static.s123-cdn-static.com/uploads/4470678/normal_600353d9bec28.pdf
- https://cdn.sqhk.co/vamosopon/TjejhJO/como_puedo_checar_mi_saldo_at_t.pdf
- https://static.s123-cdn-static.com/uploads/4410730/normal_5ff56247b76cb.pdf
- https://bevowodawalejap.weebly.com/uploads/1/3/4/3/134363876/fotawesefajowale.pdf
- https://janexixowaju.weebly.com/uploads/1/3/4/3/134311399/pakesigubob.pdf
- https://cdn.sqhk.co/mapiwoda/RgeGSic/airplane_for_sale_florida.pdf
- https://cdn-cms.f-static.net/uploads/4425238/normal_60447e833665f.pdf
- https://cdn.sqhk.co/dusimefosix/QtCGUji/tuketofisovudu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/nazekisigiduz/gasalerololuzozumugeri.pdf
- https://uploads.strikinglycdn.com/files/d0a71bb7-3b8e-487c-be16-f40d97035d71/element_tv_reviews_65-inch.pdf
- https://uploads.strikinglycdn.com/files/6287e977-2be3-4557-b98a-f1485df574ba/keurig_instructions_single_cup.pdf
- https://s3.amazonaws.com/tawovojo/free_fax_cover_sheet_template_to_print.pdf
- https://uploads.strikinglycdn.com/files/e8d52ae8-56f7-48d3-a7b2-552aec20d455/what_is_the_purpose_of_nacirema.pdf
- https://s3.amazonaws.com/vavabi/10777955833.pdf
- https://uploads.strikinglycdn.com/files/3947f810-9460-4b85-8fac-b3d14d5a05cb/27508888872.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000151c4.bin861c6c5d051d9debffed6167f82923b3bbc77872f14fe12f9e8ebf4351b60f1b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x151C4 | 5240 bytes |
font_01_sfnt_off000163a8.bin3559f410c4eada167c3fcb33066fb89517031dbe0148742cf6065e3435a89d9d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x163A8 | 11164 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.