MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI that mimics a search result, likely intended to trick the user into visiting a malicious website. No scripts were extracted, but the presence of an external URI and the phishing classification strongly suggest a social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=australasian+philosophy+family+tree
- http://nipokaxa.getenjoyment.net/arduino_programing_language.pdf
- https://cdn-cms.f-static.net/uploads/4481156/normal_60240e1bb8292.pdf
- http://fabujisaw.mygamesonline.org/nike_air_force_1_pixel_gold_chain_white.pdf
- https://cdn-cms.f-static.net/uploads/4392660/normal_601e57ecdf279.pdf
- http://jevijuratovate.22web.org/synonyms_and_antonyms_worksheet_year_5.pdf
- http://tujozavido.66ghz.com/expenses_by_vendor_detail_report_quickbooks_desktop.pdf
- http://noriwisisun.iblogger.org/unicorn_head_colouring_sheet.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://notijukigexu.rf.gd/palig.pdf
- https://s3.amazonaws.com/rovikibixu/disney_world_crowd_calendar_today.pdf
- https://uploads.strikinglycdn.com/files/46cde758-dc40-44fc-af68-428d5b19b95a/ruvazujukebafin.pdf
- https://uploads.strikinglycdn.com/files/44ef54b7-ae22-4cb9-9077-e925c3028584/how_to_replace_intellichlor_ic40.pdf
- https://s3.amazonaws.com/peveziwoguxuzam/chutti_tv_tamil_movies.pdf
- https://uploads.strikinglycdn.com/files/cbccad56-86ee-4f07-87e1-990d0767b539/24396872053.pdf
- https://uploads.strikinglycdn.com/files/f870caeb-3988-4038-9297-510761632b1e/how_much_is_disney_california_adventure.pdf
- https://uploads.strikinglycdn.com/files/d0e2f3bf-339f-4f7d-b7f0-aab2161bfe36/toner_do_drukarki_hp_laserjet_2100.pdf
- https://uploads.strikinglycdn.com/files/09078fb4-0271-4642-93a9-67d786e9daa2/kutawerutexumododew.pdf
- https://uploads.strikinglycdn.com/files/24f4e854-2ded-494f-bf9c-1901dcafc85d/activate_windows_10_pro_for_free_2020.pdf
- https://s3.amazonaws.com/tevomenil/zokalesur.pdf
- https://uploads.strikinglycdn.com/files/5d13a4b2-a1ff-4e84-97a2-5c8ca1ec8d22/32417657323.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011f25.bin3bc432a2acb46c1092567d39b909c35459484322ffc6aec47ee9340eec7b5d1c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F25 | 5232 bytes |
font_01_sfnt_off000130d2.bindddb2b97d13e1745f39c717d1041a51f260d19c9e3ee0879f8a67a5048c8ee97 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x130D2 | 10964 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.