MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to 'information literacy skills' to entice users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/aws?utm_term=what+are+the+information+literacy+skills
- https://static.s123-cdn-static.com/uploads/4408464/normal_600057e1bc513.pdf
- https://cdn.sqhk.co/zijatiki/Khboihu/81175546352.pdf
- https://cdn-cms.f-static.net/uploads/4490724/normal_6031494719959.pdf
- https://cdn-cms.f-static.net/uploads/4501206/normal_6046fb3a48d1c.pdf
- https://static.s123-cdn-static.com/uploads/4461229/normal_5fce236a3d0e4.pdf
- https://cdn.sqhk.co/xobupiba/gjjaiiT/wrestling_revolution_3d_pc_download_free.pdf
- https://static.s123-cdn-static.com/uploads/4450721/normal_5febcd37f2577.pdf
- https://static.s123-cdn-static.com/uploads/4408187/normal_5feb617f32546.pdf
- https://cdn-cms.f-static.net/uploads/4464315/normal_6049491c0604b.pdf
- https://cdn.sqhk.co/semiwewedazi/1ljdjil/super_miner_grow_miner_apk.pdf
- https://cdn-cms.f-static.net/uploads/4369916/normal_600f91e634745.pdf
- https://static.s123-cdn-static.com/uploads/4478131/normal_5fc7e92701776.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a854ab30-b85e-4f25-aa1f-c6a51ef0818a/vw_maintenance_schedule.pdf
- https://uploads.strikinglycdn.com/files/fc536ca2-bdc1-4da2-90de-7c850196f9a7/skilsaw_mag_77_replacement_cord.pdf
- https://uploads.strikinglycdn.com/files/7138b0e8-3b42-440c-873f-7c40356d526d/midnight_sun_full_movie_online.pdf
- https://uploads.strikinglycdn.com/files/cecab540-f4d9-4398-8c41-34cc35272e6b/how_to_pick_peanuts_in_hay_day.pdf
- https://uploads.strikinglycdn.com/files/a9b39358-0248-4994-8205-185b189066f3/gukif.pdf
- https://uploads.strikinglycdn.com/files/70759b76-5288-4279-9911-576af1de46a4/is_it_worth_to_learn_android_development_in_2020.pdf
- https://uploads.strikinglycdn.com/files/256431e6-78b2-491b-9cc0-2b119eaad008/binejemofumofozegowavuvud.pdf
- https://uploads.strikinglycdn.com/files/c83bc9ba-52eb-4a8a-ab01-04b5e1219498/fifty_shades_freed_book_summary.pdf
- https://uploads.strikinglycdn.com/files/479a9279-333b-4261-af3b-4a38c48a463a/41208624790.pdf
- https://uploads.strikinglycdn.com/files/6ea3128e-bdbf-4a99-aa9f-8ea27c5071da/right_to_equality_before_the_law_meaning_in_hindi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eeb4.bin7357b7a536dc98f1a746f83bbc276e23f033a41e5a3140c6bd61eced555f9352 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEB4 | 5300 bytes |
font_01_sfnt_off000100a7.bin8ea8191213e45b23321bd8528a47fc17e1fd3aa43da08e7ee655bd175fae708e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100A7 | 10620 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.