MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'lozipotod.ru', which is likely part of a phishing lure, potentially related to downloading a game mod. The presence of a download button heuristic further supports a phishing or scam attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/wix?keyword=stormfall+saga+of+survival+mod+apk
- https://cdn.sqhk.co/rojarimeg/5hhjchg/slither._io_cheats_2020.pdf
- http://puvepum.getenjoyment.net/el_hijo_horacio_quiroga_analysis.pdf
- https://cdn.sqhk.co/dafagupovo/Z3zX9gi/cabinet_dentaire_dent_de_lait_ixelles.pdf
- http://xogunajeraxuda.mywebcommunity.org/cuisinart_dcc-3200_glass_carafe_handle_programmable.pdf
- http://xizerunax.scienceontheweb.net/satekovaforawabas.pdf
- https://cdn.sqhk.co/nejajevafode/Bknijhi/tulukudo.pdf
- http://paruxezogu.mygamesonline.org/81902813179.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_69c15b22f5f74c3fa19c1b0f4317b331.pdf?index=true
- https://s3.amazonaws.com/tofizo/wall_laminate_sheets_philippines.pdf
- https://s3.amazonaws.com/jodabiladezot/belt_and_road_initiative_indonesia.pdf
- http://kutoxinupuroxo.onlinewebshop.net/divinoxededepol.pdf
- https://s3.amazonaws.com/pukiza/41942206765.pdf
- http://kesuzidadubitik.rf.gd/barriers_to_effective_communication_essay.pdf
- http://dujulekofolurad.rf.gd/50632214122.pdf
- http://tapoloferazuziw.atwebpages.com/graco_x5_manual.pdf
- https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_7f22e33a8c0042a687558a272eda8837.pdf?index=true
- http://pobevejilu.rf.gd/37941662907.pdf
- https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_03540b7012cf470083041f9167b68fb5.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef60.bin0a6bc34172baf24b71407bc3f2c28239dba02aae0fd33b41741e8e2c24565565 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF60 | 5588 bytes |
font_01_sfnt_off00010254.bin5eea94b2b28dfcb38fe2e3b17410d28b8327e76921cbb2c14ae5de77e11b7a07 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10254 | 11116 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.