MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains multiple embedded URLs, one of which, https://xezojetit.ru/wix?keyword=worksheet+gas+stoichiometry, is flagged as an external URI. The document body, though heavily obfuscated, suggests a lure related to 'Worksheet gas stoichiometry'. The presence of embedded URLs and the nature of the detection indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/wix?keyword=worksheet+gas+stoichiometry
- http://instacopyrighthelpteam.com/21912567542lfxl3.pdf
- http://shopbest.online/what_worldwide_events_happened_in_1900r5zk6.pdf
- http://dusikazo.mypressonline.com/the_antinomian_controversy.pdf
- http://moreprodukti.com/34239250158r2kgo.pdf
- http://nefutekugurenap.mygamesonline.org/causes_of_environment_pollution.pdf
- http://flowerport.shop/derwent_inktense_blocks_72_australiac4ndl.pdf
- https://cdn.sqhk.co/tefulobesa/9ge9heQ/63228841197.pdf
- https://cdn.sqhk.co/radofufalam/11thfSf/sushant_singh_rajput_songs_mashup_mp3_download.pdf
- http://jodazok.22web.org/introduction_to_systematic_theology_louis_berkhof.pdf
- http://tur8osale.site/bolimesuviregesosekek44xyc.pdf
- https://cdn.sqhk.co/zamepeja/UichcIv/sajatozi.pdf
- http://dugarudewemudo.sportsontheweb.net/23915051409.pdf
- http://avit0.pro/xefudibapadk3ayh.pdf
- https://cdn.sqhk.co/vobevufubito/CLaXvgd/mars_trine_mars_synastry_tumblr.pdf
- http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdf
- https://cdn.sqhk.co/mowanideju/jbsgiqf/lipiratilinonuzufukat.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bakilipos.epizy.com/badmash_company_songs_djmaza._com.pdf
- http://wotawegij.rf.gd/49576047207.pdf
- http://pofutujasex.rf.gd/sociological_theories_on_poverty.pdf
- http://puvepedep.epizy.com/3753632818.pdf
- http://kiganume.epizy.com/4279172125.pdf
- http://bakilipos.epizy.com/30680480662.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e21d.binda728c4f9f430223b94a3f4d8b935a1042ca4360107379500cbc18c4297e5c5b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE21D | 5360 bytes |
font_01_sfnt_off0000f445.binbfeb02015a31de80ebecae7718aab56d104175a1eea26f9d7a03e52b82cc5ae4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF445 | 10036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.