MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL that mimics a search query for 'Regents biology digestive system lab answers', likely intended to trick users into visiting a malicious site. The PDF structure and embedded URI heuristic further support the phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/wix?keyword=regents+biology+digestive+system+lab+answers
- https://cdn-cms.f-static.net/uploads/4411944/normal_601a418924314.pdf
- https://cdn-cms.f-static.net/uploads/4470835/normal_5fdb010220469.pdf
- https://static.s123-cdn-static.com/uploads/4369332/normal_5fe133736e91b.pdf
- http://senteber.site/312084758649uq7g.pdf
- http://bizarur.iblogger.org/bilbao_map.pdf
- https://static.s123-cdn-static.com/uploads/4448558/normal_5ff758a6a59bc.pdf
- http://vash-komfort5.ru/manual_blood_pressure_cuff_sizeso8dsx.pdf
- http://idslim-italia.site/53902195849exi2q.pdf
- https://cdn-cms.f-static.net/uploads/4478687/normal_5fd7091dca153.pdf
- http://top-agent.ru/23649700537ls3s9.pdf
- http://dibowofu.22web.org/pfas_drinking_water_guidelines.pdf
- http://bestcreditcheck.info/magic_map_twilight_forest9olaj.pdf
- https://static.s123-cdn-static.com/uploads/4454681/normal_5fdf9cc5bd7aa.pdf
- https://cdn-cms.f-static.net/uploads/4392668/normal_601a493995a6e.pdf
- https://static.s123-cdn-static.com/uploads/4409098/normal_5ff854600a4f2.pdf
- http://fontawesome.iohttp://fontawesome.io/license/
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fadifisevak.epizy.com/cluster_headache_guideline.pdf
- http://nodibuxirojijok.epizy.com/37052432115.pdf
- https://s3.amazonaws.com/gapivegek/filariasis_pathogenesis.pdf
- https://s3.amazonaws.com/poresi/13279781770.pdf
- https://s3.amazonaws.com/xebuvuwov/dajulajomiwutejejo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dcbd.bind31a6c76fdfb1279fd82e9b8de14b9e75b15dce9023afbccd6cb29ddbe621367 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDCBD | 1708 bytes |
font_01_sfnt_off0000e515.bin1e49af75e7412b6cfea84cc9956e0c212851d4517a69c6a80fb316568b73cc96 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE515 | 5544 bytes |
font_02_sfnt_off0000f7f5.bin54c4b60c050147a683bf5ad8b0a0966507a93da44ef98dec4187602b7b40dbda |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7F5 | 10124 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.