MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'https://botokaw.ru/strik?utm_term=excel+vba+range+value+value2', which is likely part of a phishing lure or malware distribution chain. The document body, though heavily obfuscated, suggests a context related to Excel VBA, further supporting a phishing or social engineering attack vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=excel+vba+range+value+value2
- https://static.s123-cdn-static.com/uploads/4458618/normal_6002fe2b51230.pdf
- http://tuxodoj.22web.org/75404359276.pdf
- https://cdn-cms.f-static.net/uploads/4483623/normal_60673d5c03c29.pdf
- http://lovefoxesi.iblogger.org/95707474458.pdf
- http://jirapunobos.22web.org/zilokeziraj.pdf
- https://cdn-cms.f-static.net/uploads/4481515/normal_60510e976e7c2.pdf
- https://cdn-cms.f-static.net/uploads/4365600/normal_602906a6194fe.pdf
- https://cdn-cms.f-static.net/uploads/4490738/normal_605f19b6024de.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tikoweravisixu/balafij.pdf
- https://s3.amazonaws.com/tixeligufokup/sample_narrative_report_in_brigada_eskwela.pdf
- https://uploads.strikinglycdn.com/files/91946cb6-9188-420e-9c2f-40cd9c9830dc/barnett_wildcat_c5_quiver.pdf
- https://uploads.strikinglycdn.com/files/223e49da-36cb-4516-994f-d75542425490/94531724439.pdf
- https://uploads.strikinglycdn.com/files/c55fb143-eff9-4365-a174-8d696e95610f/wofen.pdf
- http://godimodasixor.rf.gd/fedizozurogo.pdf
- https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_632e19801dc447e9b0372aeb86862e03.pdf?index=true
- https://uploads.strikinglycdn.com/files/653520da-a5c9-416c-aea7-1c4f3e000375/32999361136.pdf
- https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_d78ec89156934487bb4bc1a46deb8b50.pdf?index=true
- http://vubolax.epizy.com/rafusomorazonarowi.pdf
- http://noxoxuf.rf.gd/xidij.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000108e1.bined5df9f0c101f32861746131fc68755094045cb77a2ac4dbc3a918e1b7e3555e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108E1 | 5144 bytes |
font_01_sfnt_off00011a82.binf4c80d86345d4623a243f4ae1357ac53c6ed79732f1e5b5c091b973fd4522cc2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A82 | 11816 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.