MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely to deliver a malicious payload or phish for credentials. The document body, though heavily obfuscated, appears to be a lure related to educational topics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/wix?keyword=classroom+management+styles+appropriate+for+inclusive+education
- https://static.s123-cdn-static.com/uploads/4499282/normal_5fefa70fc4a20.pdf
- http://guzanarogenuje.iblogger.org/87255692597.pdf
- http://xurijozidarov.22web.org/xumoxevofovavisugaz.pdf
- http://jiwasek.22web.org/how_to_use_voice_remote_on_dish.pdf
- http://rituwomijemof.iblogger.org/47080100433.pdf
- https://static.s123-cdn-static.com/uploads/4401972/normal_5ffd341b93fb5.pdf
- https://cdn-cms.f-static.net/uploads/4390663/normal_5fdba79bcf65e.pdf
- https://cdn-cms.f-static.net/uploads/4426572/normal_5fdbd240672bb.pdf
- https://cdn-cms.f-static.net/uploads/4464303/normal_5fe8676e8ba5c.pdf
- https://static.s123-cdn-static.com/uploads/4371536/normal_5fc876120d930.pdf
- https://cdn-cms.f-static.net/uploads/4464301/normal_603c334ab1699.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zavufomagug.rf.gd/army_of_the_dead_sub_indo.pdf
- https://uploads.strikinglycdn.com/files/375aec86-7388-4e71-b85d-e953a47593df/82877766157.pdf
- https://uploads.strikinglycdn.com/files/2c0f3b97-8000-47ba-9581-07220dce492e/75118196701.pdf
- https://uploads.strikinglycdn.com/files/8b31be90-ef98-4fac-9d02-0ca3ca1d4d4a/poetic_ways_to_describe_a_sunrise.pdf
- http://lisuwar.rf.gd/letter_d_worksheet_for_preschool.pdf
- http://figopovu.epizy.com/gemuninuwepudilomoda.pdf
- http://nosirewelavof.epizy.com/what_is_the_goal_of_psychoanalytic_approach_to_group_therapy.pdf
- https://uploads.strikinglycdn.com/files/aedc2422-e052-4d36-8109-eef7f75143fa/wipabogewunim.pdf
- http://vugikalijuboxo.epizy.com/cisco_nexus_9300-_ex_configuration_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e88e.bine04820bcf871cae2dadc3e076ca9504d4c219c20334155a1bba70a36653cb6b4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE88E | 5540 bytes |
font_01_sfnt_off0000fb5e.bin20f4f5786c944b3ad1bbe2285ad40e7b93d5d427c56a82221e2e16f97a80b6c7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB5E | 10456 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.