MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URLs suggest a phishing or malware distribution campaign, likely using the document body's text as a lure. The presence of multiple external URIs points to the document's role in directing users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=exodus+leon+uris+pdf+free+download
- http://cocobuka3.xyz/45153674314q6prd.pdf
- https://cdn-cms.f-static.net/uploads/4382193/normal_601830678d407.pdf
- https://zegadakupoxak.weebly.com/uploads/1/3/4/7/134749069/c937f61b79afb.pdf
- https://bitipares.weebly.com/uploads/1/3/1/3/131379103/vadakuruxoribavile.pdf
- http://nofomox.22web.org/28182998589.pdf
- http://xtina.online/black_panther_cast_2hpvsi.pdf
- https://lifalaril.weebly.com/uploads/1/3/4/8/134883644/pixow.pdf
- http://rodsfish.club/carvedilol_msdsuxk0t.pdf
- https://static.s123-cdn-static.com/uploads/4421767/normal_5fc67d95a1595.pdf
- http://korirojasutito.22web.org/19604202610.pdf
- https://cdn-cms.f-static.net/uploads/4465259/normal_60124656b653e.pdf
- https://lexabefi.weebly.com/uploads/1/3/1/3/131384613/5083243.pdf
- https://static.s123-cdn-static.com/uploads/4380869/normal_5ff0bbc7c0cc3.pdf
- http://disavunasozovod.iblogger.org/hongkong_land_annual_report.pdf
- https://cdn-cms.f-static.net/uploads/4465136/normal_6022e60950de8.pdf
- http://trudogoliya.online/97017147256h4oet.pdf
- https://static.s123-cdn-static.com/uploads/4389101/normal_5ffb7312ab432.pdf
- https://cdn-cms.f-static.net/uploads/4458849/normal_602a70f8be6e3.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://meferujapepaz.epizy.com/chiari_malformation_type_1_uptodate.pdf
- https://s3.amazonaws.com/padosumifubobo/42827591651.pdf
- https://s3.amazonaws.com/vonutavekip/dinoxefijuvukem.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ccab.binc8e9cb269041ad8e6020839b6251953ebe4cafa2fa0d401158366944dbb88405 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCCAB | 4952 bytes |
font_01_sfnt_off0000dd9c.bin75564176d5758500972f82908d7895e82dc3ce7bb3d2ca2325cbe1f20c6d28cd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD9C | 10184 bytes |
font_02_sfnt_off0001006b.bin05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1006B | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.