MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. ClamAV and an ML classifier also flagged this PDF as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, appears to contain text related to a movie song, likely serving as a lure to entice users to click the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/123?utm_term=bheema+movie+song++starmusiq
- http://gopubewigofopa.iblogger.org/muribumuginitipuxofel.pdf
- http://xofezibukironex.iblogger.org/kafka_metamorphosis_critical_review.pdf
- https://cdn.sqhk.co/baxewoxevum/Qgcgigh/flight_tracker_arrival_klia.pdf
- https://cdn.sqhk.co/makafabakuna/ViaStjd/bewakisazij.pdf
- http://vowugewekoperak.iblogger.org/wunudabuzubetaf.pdf
- https://cdn.sqhk.co/rafujajek/7chhHji/xemojenilarilinudawepuneb.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/27fb18c5-af51-4631-9709-76b7299b156e/how_to_use_a_6_cup_rice_cooker.pdf
- https://s3.amazonaws.com/dewazewokib/car_racing_games_for_laptop_free.pdf
- https://s3.amazonaws.com/lumixi/sisuzibow.pdf
- http://jagakemiwowinig.epizy.com/riselufesevolulovo.pdf
- http://pizodixevefok.rf.gd/assimilation_linguistique.pdf
- https://s3.amazonaws.com/voxipanovigepiv/most_powerful_indoor_tv_antenna_uk.pdf
- http://talamilikobapi.epizy.com/dezolapuvik.pdf
- https://uploads.strikinglycdn.com/files/cd3c2f62-395a-4c61-b8d7-4f055818d4d9/sketchup_make_free_version.pdf
- https://s3.amazonaws.com/goviwigax/56041303056.pdf
- https://uploads.strikinglycdn.com/files/91cd672a-7bd3-414c-be53-bb9a1f97eb29/what_do_you_capitalize_in_a_title_apa.pdf
- https://s3.amazonaws.com/padosumifubobo/towulefajukimo.pdf
- https://s3.amazonaws.com/wuniku/hilti_re_500_technical_data_sheet.pdf
- https://uploads.strikinglycdn.com/files/5d02ad0b-72c1-494d-8b78-983324e492cb/vox_ac30c2_tube_chart.pdf
- http://menaronutex.epizy.com/kemafopefidif.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1d1.bin4e41d8ee5225445eb8df814fd0c99adc36e941c87ed6b8161ae245488c88dd08 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1D1 | 5304 bytes |
font_01_sfnt_off000103b6.bin3858f23381494caa1b1e528911fb81e6495907cd27ca42bebd52f467ee660f8f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103B6 | 11512 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.