MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to contain text related to audio interfaces, suggesting a lure to trick users into visiting the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=scarlett+18i20+3rd+gen+vs+clarett+8pre+usb
- https://cdn-cms.f-static.net/uploads/4417023/normal_600a1901828fa.pdf
- http://salonapp.xyz/approve_employee_timesheetsp5ocr.pdf
- http://baby-slings.ru/science_of_logic_marxists4a6xp.pdf
- http://helpcenter.business/jutedufiv473xt.pdf
- http://samelike.site/7072435550045sns.pdf
- http://netewe8.xyz/mupiferaliketmf3e.pdf
- https://cdn-cms.f-static.net/uploads/4488316/normal_60490797a27fd.pdf
- https://cdn-cms.f-static.net/uploads/4390642/normal_6028953f8ebd8.pdf
- https://cdn-cms.f-static.net/uploads/4376380/normal_60446810e7abb.pdf
- https://cdn-cms.f-static.net/uploads/4501495/normal_602542768cb62.pdf
- https://static.s123-cdn-static.com/uploads/4374851/normal_5ff7d8f8353a8.pdf
- https://static.s123-cdn-static.com/uploads/4481155/normal_6004066979f43.pdf
- http://ipoteka.net/what_would_cause_my_dryer_not_to_heatx7d2z.pdf
- http://swiss-family.space/life_cycle_of_anthocerosbk4pr.pdf
- http://wowmarket.info/41545620708qsmck.pdf
- http://storeyou.store/salon_de_belleza_mario_bellatin_analisis_literarioi8n86.pdf
- http://giftcard-sale.store/what_are_the_12_rules_for_radicalsgrtff.pdf
- http://investmag.org/excel_spreadsheet_project_budget_templatevqzza.pdf
- http://sebezedamewem.iblogger.org/bededolasipevajuxi.pdf
- https://cdn-cms.f-static.net/uploads/4455902/normal_601bfce15841a.pdf
- http://hdsamara.ru/zejazuroropoluzormq1f.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://lebozid.epizy.com/89011266439.pdf
- http://kojosire.epizy.com/64736899714.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f5f3.binf55ac4831a370c541afba18b2add2b9087b72ae5f26167d10a8402ed0d9bffe0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5F3 | 6228 bytes |
font_01_sfnt_off00010b2b.bindf614e8d7e96b542a568fd6497d47b7c20659253b6d0837d5671450e4e72a1cc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B2B | 10992 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.