MALICIOUS
116
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain associated with phishing or malware distribution, suggesting the document is part of a lure to download further malicious content. No scripts were extracted, but the presence of external URIs and the ML detection strongly suggest a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9782
Heuristics 5
-
PRC/3D content in PDF medium PDF_PRC_3DPDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://medvor.ru/pbw?utm_term=diwan+e+shams-e+tabrizi+in+urdu+pdf+download PDF link annotation
- https://zidadosivifaju.weebly.com/uploads/1/3/0/7/130775619/wunetojixox-welakubiwanadix.pdfIn PDF document text
- https://wetugaremuzen.weebly.com/uploads/1/3/5/2/135298520/6907296.pdfIn PDF document text
- https://xizotikozuza.weebly.com/uploads/1/3/4/5/134587863/kawesoriv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488130/normal_6041f01ad86fd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457857/normal_6029346266f37.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4487888/normal_5fccc3a479a15.pdfIn PDF document text
- https://nitenativab.weebly.com/uploads/1/3/4/6/134698737/5476467.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459328/normal_6066f0b046b0b.pdfIn PDF document text
- https://zedodunojoponex.weebly.com/uploads/1/3/6/0/136083391/wowupurez_kolizugir.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://vimadutukad.pbworks.com/f/libros_robert_kiyosaki_espaol_gratis.pdfIn PDF document text
- http://bavudexote.pbworks.com/w/file/fetch/144751557/70893817334.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/820bf78b-66b9-426a-afea-7fc70d8a9393/zunorafutonururebajevapa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c97abbfe-2d9b-4bad-a15d-f963e840ab5e/how_to_create_a_stakeholder_map_in_powerpoint.pdfIn PDF document text
- http://zigunef.pbworks.com/f/41084310529.pdfIn PDF document text
- http://nusometa.pbworks.com/w/file/fetch/144695916/sazikajunekika.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/54f6347a-d913-4181-a7c6-9406bd4cf118/the_long-run_average_total_cost_curve_displays_declining.pdfIn PDF document text
- http://jagimikat.pbworks.com/w/file/fetch/144668886/81351039567.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ee072d5-b686-42a5-89a0-ae42c7431e30/which_azure_certification_is_best_for_developers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b36d041a-8552-472a-964a-04d9771a8de6/graphic_design_portfolio_websites_free.pdfIn PDF document text
- http://siseraxoru.pbworks.com/w/file/fetch/144485367/65236607612.pdfIn PDF document text
- http://bowawesup.pbworks.com/w/file/fetch/144541380/41895330733.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2055f24b-7acd-4ca9-b793-7f162e57d931/29257325113.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbeacf8d-d7d3-4dae-94cb-25efd930e752/guess_the_logo_level_51.pdfIn PDF document text
- http://xetibubib.pbworks.com/w/file/fetch/144425082/bridge_to_terabithia_book_chapter_1.pdfIn PDF document text
- http://vulazojab.pbworks.com/f/how_to_buy_doge_dank_memer_premium_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7afff3c8-02f8-48f0-b2f0-cd2305af7788/solar_energy_tutorial.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_007_off00041e76.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x41E76 | 31348 bytes |
SHA-256: 25fd4850c32a5c0686cf7e0751a4cbf7bc1fbd41e5a87760f4a8609101b55aef |
|||
font_00_sfnt_off0003e05e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3E05E | 5592 bytes |
SHA-256: 003287d3417a3019c886f23d10b7dc2b385700cdc9e1ffeba9061577575576cb |
|||
font_01_sfnt_off0003f359.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3F359 | 13624 bytes |
SHA-256: 10032b5a6ecc2eb0b78d46cb9d1808c3d75bfda2199b02269dfd07e357882685 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.