MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to a suspicious URL, which is likely part of a phishing or malware distribution scheme. Although no scripts were extracted, the presence of the malicious URI and the overall classification strongly suggest a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=what+time+does+the+stock+market+open+today+in+texas
- http://pexulisinipev.sportsontheweb.net/8th_grade_social_studies_practice_test.pdf
- http://rebezun.mygamesonline.org/kitchenaid_stand_mixer_tilt_5_quart_rrk150wh_artisan_tilt_white.pdf
- https://cdn.sqhk.co/pelopuxi/njhahhG/airthings_wave_plus_factory_reset.pdf
- https://cdn.sqhk.co/vedasukuki/smFjbhg/extinction_definition_ecology.pdf
- http://winatesef.sportsontheweb.net/ielts_academic_writing_task_1_sample.pdf
- https://cdn.sqhk.co/tosijoxopum/egcgfMZ/pijezijekanep.pdf
- http://fumumowovufa.mywebcommunity.org/giman.pdf
- http://kadaxejob.mypressonline.com/adobe_reader_apk_free.pdf
- http://wofirulufe.iblogger.org/author_s_point_of_view_printable_worksheets.pdf
- http://sewawena.scienceontheweb.net/80953752858.pdf
- http://kelirajisob.66ghz.com/93519423426.pdf
- http://lulopoboxefon.scienceontheweb.net/batejagemagovu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nadovudeduxawos.rf.gd/assault_cube_hack.pdf
- https://d38713d8-f9e0-49bf-8e72-3f46774ce551.filesusr.com/ugd/b3faf5_79d419d818d34c4db9da2bb9a91e68a7.pdf?index=true
- http://nozanela.epizy.com/1548303324.pdf
- https://s3.amazonaws.com/kulinisokakewi/40887796208.pdf
- https://s3.amazonaws.com/tokatefozude/firefox_bookmarks_app_for_android.pdf
- https://a161ff94-1a6f-4367-b6f8-8e513a5e676d.filesusr.com/ugd/4c7633_ab8a613cf98c4d0693f91ce1a827476f.pdf?index=true
- https://s3.amazonaws.com/lovetijif/41493849845.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f8b8.bin12c88952a90f1b085b23721459f83e400fc619a0004055e6bdd8ddb3cd1b71b9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8B8 | 5528 bytes |
font_01_sfnt_off00010b6c.bin1ba40f99c317a30265a4e869813a8724d5834ca85e4dd1f0ff8a7fa903517edc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B6C | 11240 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.