MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9983
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=%25D1%2581%25D0%25BA%25D0%25B0%25D1%2587%25D0%25B0%25D1%2582%25D1%258C+%25D0%25BF%25D1%2580%25D0%25B8%25D0%25BB%25D0%25BE%25D0%25B6%25D0%25B5%25D0%25BD%25D0%25B8%25D0%25B5+%25D0%25BC%25D1%2583%25D0%25BB%25D1%258C%25D1%2582%25D1%2584%25D0%25B8%25D0%25BB%25D1%258C%25D0%25BC+%25D0%25B4%25D0%25BB%25D1%258F+android PDF link annotation
- https://static.s123-cdn-static.com/uploads/4408584/normal_5ff606df2c1c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4498404/normal_6068b0c3268bd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380858/normal_602899502f3d1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477649/normal_604d2f724438f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495039/normal_6031075e3b07d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466676/normal_6033a227436d8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368225/normal_605f4d1cc8a43.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366949/normal_6028a652ccbbc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462985/normal_604a8e791ee30.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425723/normal_602019e09d01e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4428335/normal_6031447e8ab82.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479715/normal_5fc6128b78aac.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414353/normal_6062086d2a9cf.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/8c637099-c2cb-4560-aceb-8ade5df5c3d3/figukepukawubusilafe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8706dc2-63fa-48fc-b2db-ab0ee88a1cdf/yamaha_i-ux1_usb-midi_interface_cables.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e280d5a-1ac4-49e4-a353-457977b99d6c/sig_sauer_m17_holster_safariland.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/56cd2a4b-fbcb-470e-8cc7-7b05681aeb3b/kejetuxumepexenodana.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1835ee0c-0e90-42d2-a2cc-fb99bac31a59/guneg.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10f2916a-1505-406e-bcf1-9c1bd689473a/9487216115.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/720497f8-3557-4e04-9747-1466a4b5d1bf/40839337029.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4345361c-b74c-4b46-96a0-a7512241cf11/properties_of_matter_crossword_worksheet_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f45f1361-654a-4c49-9efa-f38d32396ed0/statistics_and_probability_with_applications_-_teacher_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/164284b7-8442-42f3-9ac1-5c94c3744592/how_to_describe_a_rainbow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5419fd0e-9224-4e7c-adbd-0f1448788444/asp.net_mvc_4.0_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/308fe289-4153-47bd-96be-1faca5a2cf5c/what_is_a_deviance_in_sociology.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e2a1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE2A1 | 6100 bytes |
SHA-256: 6e23e51890311ffd393bc7eeff80521a18ad9bdfd74393179af3e91338c57d57 |
|||
font_01_sfnt_off0000f692.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF692 | 16328 bytes |
SHA-256: f52bafd4fadafb626a365f93c6ddfc828c530048dc616ad2407525360b1e2461 |
|||
font_02_sfnt_off00012916.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12916 | 16204 bytes |
SHA-256: a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd |
|||
font_03_sfnt_off00013e43.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13E43 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.