MALICIOUS
116
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document detected as malicious by ML classifiers and ClamAV, specifically flagged as Pdf.Phishing.Trojan. It contains an embedded URI pointing to a suspicious domain, and multiple other URLs that could serve as download locations for further payloads. The presence of a QR code lure suggests a phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
QR-code redirect lure medium SE_QR_LUREDocument instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=daily+guideposts+40+devotions+for+lent
- https://cdn.sqhk.co/dimumaneda/dhijhdt/baviduwozufafuwisew.pdf
- https://cdn.sqhk.co/notizejamebo/jEihvgj/47809380493.pdf
- https://static.s123-cdn-static.com/uploads/4376382/normal_5ffcfbef1e0d0.pdf
- https://cdn.sqhk.co/vamunidibu/hghbNOf/65499646608.pdf
- http://pakekoramiduwin.getenjoyment.net/adobe_indesign_cc_classroom_in_a_book_free_download.pdf
- https://static.s123-cdn-static.com/uploads/4450889/normal_5fefdd3c95e67.pdf
- https://cdn.sqhk.co/bofotabi/hffiheC/coliformes_definicion_quimica.pdf
- https://cdn-cms.f-static.net/uploads/4487663/normal_5fd27b518409b.pdf
- https://cdn.sqhk.co/poladejug/cjgibIj/koaa_train_live_location.pdf
- http://ramuwesitavoz.mywebcommunity.org/why_cant_i_share_public_post_on_facebook.pdf
- https://cdn.sqhk.co/birenejar/jtNdRhg/83572951827.pdf
- https://cdn.sqhk.co/kowalaxu/XggDBjc/disney_plus_free_trial_verizon.pdf
- https://cdn.sqhk.co/kufalavoxig/ibjixih/dizoxuleveregire.pdf
- https://cdn.sqhk.co/kamugututu/eidvjQe/billie_eilish_age_ocean_eyes.pdf
- https://cdn.sqhk.co/ludozenidi/gd0PJjZ/zagilegijekojatoz.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/gurowozenupifi/xerepebadogeduvo.pdf
- https://s3.amazonaws.com/bejideba/zatufejij.pdf
- https://s3.amazonaws.com/fexuror/wogewusujezososuje.pdf
- http://dafuwinev.myartsonline.com/4025864752.pdf
- https://s3.amazonaws.com/lovomijelun/java_swing_button_text_color.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d66a.bineb0d6496336e52107c25036c9c2f25ab82c7709ba10ab0ed19859885606a6d6e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD66A | 5600 bytes |
font_01_sfnt_off0000e9a9.bin05e16621c3f5bead309200ec3f8d5393b3d0d63460042ff2a60482ab293df2be |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9A9 | 10692 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.