MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that mimics a search query, designed to trick users into believing it is a legitimate search result. This URL, https://lozipotod.ru/award?keyword=how+much+oil+does+a+2006+nissan+altima+take, is the primary indicator of malicious intent. The file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, strongly suggesting it is a phishing or malware delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9775
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/award?keyword=how+much+oil+does+a+2006+nissan+altima+take PDF link annotation
- http://siwosupegejolop.medianewsonline.com/56747419517.pdfIn PDF document text
- http://sacredname.ru/792805164712i8zn.pdfIn PDF document text
- http://mirijesuwakug.sportsontheweb.net/is_per_capita_income_gross_or_net.pdfIn PDF document text
- http://idealslimitaly-official.site/constitucion_de_venezuela_1811_resumenikcyf.pdfIn PDF document text
- http://fotubobuwenapu.scienceontheweb.net/metro_2035_book_review.pdfIn PDF document text
- http://fajujefa.getenjoyment.net/basozufigedogur.pdfIn PDF document text
- http://taxevidel.medianewsonline.com/gagetopurefepulo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/zunewidimem/rejaratugurogazenufefosaf.pdfIn PDF document text
- http://rujidafedisezu.atwebpages.com/42772735322.pdfIn PDF document text
- https://s3.amazonaws.com/lusabifef/wokezafetamupesiwix.pdfIn PDF document text
- http://vujuvisesakok.myartsonline.com/bonezat.pdfIn PDF document text
- http://rukukuwozar.epizy.com/bullying_in_school_news_report.pdfIn PDF document text
- http://gewumene.epizy.com/top_10_anti_malware_android.pdfIn PDF document text
- https://s3.amazonaws.com/patilawasu/70860661316.pdfIn PDF document text
- https://s3.amazonaws.com/guvovigo/draw_sheets_for_lawn_bowls.pdfIn PDF document text
- http://resisimokopi.epizy.com/17672896512.pdfIn PDF document text
- https://s3.amazonaws.com/varolexexus/fumixifu.pdfIn PDF document text
- https://s3.amazonaws.com/votuweroxigezog/barbie_dreamhouse_adventure_hack_apk.pdfIn PDF document text
- http://rilexukalenenig.rf.gd/87422378250.pdfIn PDF document text
- https://s3.amazonaws.com/genukopapovixo/starch_and_iodine_diffusion_lab_answers.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f464.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF464 | 5628 bytes |
SHA-256: b385b957f7f83d4cafffdc0a1205c95a4cabe4a44abb49d75366cbf7f1876931 |
|||
font_01_sfnt_off00010772.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10772 | 10180 bytes |
SHA-256: cf1cbe7d6889100fe36fc758a5ad5293652f9cb0bf922b62725f4d224b50270e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.