MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'vilenefex.ru', which is likely a distribution point for malware or a phishing page. The presence of a 'download button' heuristic further supports the phishing lure attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=sharpshooter+pubg+hack+apk+free+download
- https://static.s123-cdn-static.com/uploads/4374185/normal_5fc7976a2a4b6.pdf
- https://cdn-cms.f-static.net/uploads/4487658/normal_604612c4601d8.pdf
- https://static.s123-cdn-static.com/uploads/4409827/normal_5ffc488b98d66.pdf
- https://static.s123-cdn-static.com/uploads/4454541/normal_5ff97d9506843.pdf
- https://cdn-cms.f-static.net/uploads/4393790/normal_60129d61ca11c.pdf
- https://cdn-cms.f-static.net/uploads/4423453/normal_60219d75e50f1.pdf
- https://cdn-cms.f-static.net/uploads/4378386/normal_6030cc7b0126e.pdf
- https://cdn-cms.f-static.net/uploads/4374688/normal_605f84d931a2a.pdf
- https://static.s123-cdn-static.com/uploads/4454550/normal_5fc6c7b6e4307.pdf
- https://cdn-cms.f-static.net/uploads/4531626/normal_600fae7aaa3cc.pdf
- https://cdn-cms.f-static.net/uploads/4457279/normal_602a0a31ac5a2.pdf
- https://cdn-cms.f-static.net/uploads/4487192/normal_601c7bd8cec15.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/3c63c633-a25b-4a1c-966b-b73eaf870f18/starbucks_barista_espresso_machine_instructions.pdf
- https://uploads.strikinglycdn.com/files/b7120008-d5f0-4161-a821-4b98c7d06346/how_to_black_and_decker_coffee_maker.pdf
- https://uploads.strikinglycdn.com/files/e6ffa9a1-ecee-45fd-98e7-445756223945/73952091855.pdf
- https://uploads.strikinglycdn.com/files/b91aa69d-59ba-4134-8953-4ccc5444166d/how_much_is_navy_salary_per_month.pdf
- https://uploads.strikinglycdn.com/files/4d0fbdb0-97a8-45c0-8e12-dfadc2a42a93/is_trans_surgery_free.pdf
- https://uploads.strikinglycdn.com/files/f768a6f6-3d1b-4cf6-bee2-97fb908f0d03/volixutefolixil.pdf
- https://uploads.strikinglycdn.com/files/078c289f-8517-4396-8755-72a2c2937f89/pureguardian_humidifier_clean.pdf
- https://uploads.strikinglycdn.com/files/88766273-18dc-4748-b0ad-46a2ec556808/pioneer_deh_80prs_manual.pdf
- https://uploads.strikinglycdn.com/files/765fd394-5151-40d1-a98b-01edeec6e2bd/why_is_my_wifi_extender_blinking_red.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f44a.bin048fb1891f432488516cd811e7b04d68e7d39e548ca3495625137f8fb0c23ff4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF44A | 6744 bytes |
font_01_sfnt_off0001052f.bin8ab928da0439fc1734bbd94b4c8f498843a52db6160943e391c532f4dd2229f8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1052F | 5816 bytes |
font_02_sfnt_off00011904.bin03444500aff6a21864510b4a5635d60527f84bd0e63ca783de5e0a69a8c5c568 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11904 | 11252 bytes |
font_03_sfnt_off00013fc9.binf486dddef08303a1e21112e80253427336bbbe3e13ae138e55ae3cd6181acef1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13FC9 | 16304 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.