MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://zajinet.ru/wix?keyword=kotor+android+apk+reddit', which is likely intended to trick the user into downloading malware or visiting a phishing site. The document body, though heavily obfuscated, contains metadata related to the URL's apparent purpose.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/wix?keyword=kotor+android+apk+reddit
- https://static.s123-cdn-static.com/uploads/4475208/normal_5ff883a623707.pdf
- https://cdn-cms.f-static.net/uploads/4387709/normal_5fd2012f747b2.pdf
- https://static.s123-cdn-static.com/uploads/4472208/normal_5fde6a1b4bf5b.pdf
- http://xsafak.com/angel_of_mine_monica_freeooy4g.pdf
- https://cdn.sqhk.co/wenejusuzixe/ijfyifM/capsicum_nutrition_guide.pdf
- http://calipshatngaccs1.xyz/zosutiloketonovue5jwd.pdf
- https://cdn-cms.f-static.net/uploads/4455642/normal_5fd7482ca7315.pdf
- http://899themes-demo.ru/435518318902qy9r.pdf
- https://cdn.sqhk.co/lulufebexefe/ewjf8WV/erik_satie_gymnopedie_no_2_sheet_music.pdf
- http://clipshd.design/93143476380naqth.pdf
- http://shoop-fm.ru/rizone_beep_codes_viewer_free8y53t.pdf
- http://deutschebank-meine.com/forklift_truck_training_in_dublinnbhhe.pdf
- http://daravto18.ru/best_new_survival_movies_2020atplj.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://8767aa75-4bd5-48c0-94ca-24e983238001.filesusr.com/ugd/debdc1_2a8b929068e24d78ac1abf976b6c2f31.pdf?index=true
- http://tinosizifaxuful.epizy.com/44137878025.pdf
- http://gobusef.rf.gd/text_extraction_from_image_deep_learning.pdf
- https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_72437527ff04440eb22e9ff9940467eb.pdf?index=true
- https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_415320a26c1041838eba23961ad0f8ff.pdf?index=true
- http://fubatasofofezo.rf.gd/15974228855.pdf
- https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_ef9ce7c2a27d4114897efd5643255daf.pdf?index=true
- https://19a4122d-28db-4ec2-a9e3-8c1e87f24dd5.filesusr.com/ugd/70d0b7_e34b2074de6a48cea007ba14732ee6f7.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb47.bin395b700e1da99b7cd334fd9eb685df3999bedbcaa1953c984e1e315cab93e3f7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB47 | 4776 bytes |
font_01_sfnt_off0000fb91.binc2bb0a71a723b13277ab64317919ded42bb718e08eca6a3256ae85caf85a5a99 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB91 | 10772 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.