MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a LOLBin command-execution lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cructi.ru/pbw?utm_term=novell+far+och+jag+pdf PDF link annotation
- https://uploads.striIn macro / runtime command snippet
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/2bbafba2-14ad-4759-b082-4520496a3880/crystal_report_13.0_21_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa8aa801-6ff3-4b2d-85a3-3c8ee3a08ed2/17442423875.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8525b7e2-ef55-48ba-9e88-bf62735d4022/kesonivewikowatan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/24aaa441-557e-4583-b091-5be2fa2ad56f/las_48_leyes_del_poder_ebook_descargar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8988817d-5291-483e-b572-160fd12ccee5/does_curly_girl_method_work_on_wavy_hair.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f60ca1a9-786b-443f-ad90-9c7083f7064f/latest_nigeria_music_videos_2019_mp4_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0097ecff-95aa-4495-b61e-0d959dd5c6f8/1st_grade_math_addition_worksheets_printable.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb12d7a9-06fc-46d7-b2c2-b5dc124442d5/kulud.pdfIn PDF document text
- http://ziduzobif.pbworks.com/f/how_to_download__install_fabric_mods_in_minecraft_1.16.4.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/12295a60-33cd-4e61-a681-3b93c02664a6/nizuzabagezajozena.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5e3706c-93ef-4ce0-9dc1-a0fc4026bc69/when_the_wait_is_too_long.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a235f33-28b4-4e02-b58d-95fb8f44875c/33454502382.pdfIn PDF document text
- http://zudilazo.pbworks.com/w/file/fetch/144505026/toshiba_e_studio_2330c_driver_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75c43cb7-3a8f-442d-abb7-d9d465fb028d/kogevitedejisi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0cfeb217-ce20-473f-a5d3-b54290becca4/81093356132.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c864a3a8-57d0-4077-801b-50edd5e692ac/wasezar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5a28081-ef9c-4881-99ca-90662c0b454a/how_to_thread_a_singer_athena_2009_sewing_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/671019f0-816f-4a79-91e4-8384952646dc/blackberry_classic_telegram_apk.pdfIn PDF document text
- http://redejok.pbworks.com/f/36000220902.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2a295df-19c7-47ee-9b63-5b6d97109dff/luvafepifer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a3cdb53-48c1-4146-9619-06d2f4f1b0b6/what_should_your_lexile_be_in_10th_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd1159a3-6cd5-4271-a760-b61bd8b5106b/how_many_watts_does_a_mini_freezer_use.pdfIn PDF document text
- http://wixugigir.pbworks.com/w/file/fetch/144457110/34028735995.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010922.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10922 | 4900 bytes |
SHA-256: 8ff3d393ddf38ad3726e61f5767ed2f424292cf008e4b672874fc18d8f0ece14 |
|||
font_01_sfnt_off000119f5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x119F5 | 11708 bytes |
SHA-256: f9803842128cb2b29cd5cd7d1978ef6fef279f373bade46411e68769bf3b9554 |
|||
font_02_sfnt_off00013faa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13FAA | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.