MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF containing an embedded URL that directs to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, 'https://jacksth.ru/strik?utm_term=kenmore+elite+dryer+lint+screen+replacement', is likely part of a phishing campaign or a distribution vector for further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=kenmore+elite+dryer+lint+screen+replacement
- http://bestrongbyg.com/adobe_audition_trial_freehkm3v.pdf
- http://kudretbozaci.com/91219922152aiy35.pdf
- http://matras-24.ru/57443639082sb0rd.pdf
- http://pululap.22web.org/tabe_practice_test.pdf
- http://mmuuue.space/foloresewebivonupik50y6o.pdf
- http://straponartist.com/paladin_character_sheet_5er9sdt.pdf
- https://bepixumute.weebly.com/uploads/1/3/5/3/135302933/garexoxowikoseb-fuwol-wejopamumoxa.pdf
- http://avtoshtorki.shop/girufirembd3a8.pdf
- http://chestlune.online/navy_type_3_uniform_boot_regulationsno9b2.pdf
- https://pijafajabivigin.weebly.com/uploads/1/3/4/6/134635516/rozexo.pdf
- https://vuminuzatadabem.weebly.com/uploads/1/3/4/3/134311796/waduf.pdf
- http://exemplpusj.com/indoor_water_parks_in_paris9n46y.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_8481b3fc881b41578e89b3f683b3daf9.pdf?index=true
- https://s3.amazonaws.com/midizaxopazeji/zivalokesugunizajirotex.pdf
- https://s3.amazonaws.com/zozuxukoxo/dynamite_piano_sheet_music_free_printable.pdf
- http://nivutegem.epizy.com/dork_diaries_books_online.pdf
- https://s3.amazonaws.com/moduluzuxikari/gagalewujam.pdf
- https://a79fbd7c-12a6-44fe-9d3c-43dc2b0795a8.filesusr.com/ugd/f95141_661ba867d2b84ef08a4225b2f7c24323.pdf?index=true
- https://s3.amazonaws.com/sewamos/fake_caller_id_apk.pdf
- https://s3.amazonaws.com/kelageketisefuv/angular_templateref_in_service.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb59.bin72f28a0aad285e1112af3057a1d0df9ab2779d89a7a61f763d37945ac6e23f82 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB59 | 5288 bytes |
font_01_sfnt_off00010d4b.bin41a7c317713ce58402b641e40b89bb444ac8411179e181e29281bca450041edc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D4B | 12084 bytes |
font_02_sfnt_off00013625.bin963f0c89af7281d4a3182780b6c5b5aff601a5d5aa41651a715097ad7274c37d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13625 | 17820 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.