MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'resalured.ru' suggests the document is designed to redirect users to a potentially harmful website. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware delivery attempt, likely using social engineering to trick the user into clicking the link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/award?keyword=botanica+biologia+pdf
- http://alex-chekalev.com/persuasive_speech_outline_template_wordx78qj.pdf
- http://tramlaweq.online/wolf_of_wall_street_full_movie_watch_online_youtubeefcr6.pdf
- https://static.s123-cdn-static.com/uploads/4446030/normal_5fed32cfca02a.pdf
- http://cleanup-sale.site/family_tree_templatec1ogt.pdf
- http://tricitysikhs.com/vegala4ekd9.pdf
- https://cdn-cms.f-static.net/uploads/4366973/normal_6017242b9de32.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/zabevog/binirosafemixepetu.pdf
- https://s3.amazonaws.com/tolivajupeku/how_to_run_a_portable_dishwasher.pdf
- https://uploads.strikinglycdn.com/files/c5e3e58e-bfba-46ab-943b-a3ecda83e0ae/22971285972.pdf
- https://s3.amazonaws.com/fosagoba/xogugefefolu.pdf
- https://s3.amazonaws.com/vinivuxo/jisofa.pdf
- https://uploads.strikinglycdn.com/files/c5390f6d-aa8e-42d7-af88-11482d12cbfb/58093085823.pdf
- https://s3.amazonaws.com/vapite/copy_and_paste_1000_times_i_love_you.pdf
- https://s3.amazonaws.com/pivetuzadujo/16574390180.pdf
- https://s3.amazonaws.com/fovezewi/15069241942.pdf
- https://s3.amazonaws.com/jenisozazewubo/25356095140.pdf
- https://s3.amazonaws.com/widiku/simple_email_signature_html_template.pdf
- https://uploads.strikinglycdn.com/files/86b55fad-ae86-4ae6-8121-207b12496c36/what_to_do_if_my_samsung_won_turn_on_my.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015569.binf586355d5a23495aa9923ff508a807a9f523fc9a2434f3d14be3aa0d19ffaa10 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15569 | 5240 bytes |
font_01_sfnt_off0001674e.bin9759b29416bc94e98b151487e9e0bdbd9c5d12dcad7808c9bf5fbd9dee266334 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1674E | 15972 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.