SUSPICIOUS
36
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as suspicious by an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafficel.ru/123?keyword=b+more+careful+free+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4381544/normal_5f975847c865e.pdfIn PDF document text
- https://xumogimunosu.weebly.com/uploads/1/3/1/6/131607683/64d5146.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/2ddd9d3c-01c0-4a12-9a1b-dcec93b2c1de/jevibuduvekivager.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a723bb22-0104-494f-932e-43f338e8bf3c/77817942018.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4290f62a-56bd-497d-b032-d8a589977f12/62928853497.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/98ff6f4a-1198-4faa-9d45-858797522a30/81836083480.pdfIn PDF document text
- https://s3.amazonaws.com/metubevozisul/xasixobawoguz.pdfIn PDF document text
- https://s3.amazonaws.com/sitok/61742696215.pdfIn PDF document text
- https://s3.amazonaws.com/temujonuwu/54599161070.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0c3e6feb-d2c1-4b6d-9df7-165e32185c43/definicion_de_sistemas_de_ecuaciones_lineales.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/03fa0165-fbee-4a17-a162-1e373c30c1bb/7063600896.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/61e56165-a1bd-46db-a347-8e2e5bc709f6/paper_towns_book_free.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000884a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x884A | 4884 bytes |
SHA-256: 146a8a09869704592830dfd383fda05019e17d31ba7055008b39ec0157ac5ff4 |
|||
font_01_sfnt_off000098c9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x98C9 | 10136 bytes |
SHA-256: 3855e37eb7350d96a8562a6aebf29f98173d8c3b2b50de47d320034a70431cc3 |
|||
font_02_sfnt_off0000bb73.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBB73 | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.