MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.002 Spearphishing Attachment
The PDF contains embedded JavaScript and external URIs, indicating an attempt to deliver malicious content. The primary URL, https://colod.co.za/XSRYdR1H?utm_term=carbon+dating+math+worksheet+answers+pdf+free+edition+free, is presented as a worksheet download, which is a common social engineering tactic. ClamAV and ML classifiers confirm the malicious nature of the file, likely a phishing or trojan delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.7783
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://colod.co.za/XSRYdR1H?utm_term=carbon+dating+math+worksheet+answers+pdf+free+edition+free
- http://bibikid.ru/upload/18792792257.pdf
- https://xepejazodaka.weebly.com/uploads/1/4/1/4/141419330/4333617.pdf
- https://www.liad-alger.fr/admin/style/js/edit/kcfinder/..%5Cimages%5Ccontenue/files/vesobafomusoweze.pdf
- http://mms.vru.ac.th/kcfinder/upload_new/files/71370151222.pdf
- http://biblebaptist.kr/user_data/kcfinder/files/jumizupalapajelalu.pdf
- http://letresorellebio.it/userfiles/files/rolixa.pdf
- https://takarasushimn.com/userfiles/files/rebuzejiwiwos.pdf
- http://finsura-lifedirect.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1626a3bb2209e8---bulozuxa.pdf
- http://rostocker-taxi.de/resources/files/56317572703.pdf
- http://www.pethouse.es/ckfinder/userfiles/files/julejamuvozik.pdf
- https://buwikuzajow.weebly.com/uploads/1/3/7/5/137501860/kojologud.pdf
- https://pupalajapifev.weebly.com/uploads/1/3/1/4/131454396/bewabanorok-pakatumavuwop-kujufejusozo.pdf
- https://lawebigatu.weebly.com/uploads/1/3/1/4/131453175/9f00b.pdf
- http://www.snhram.ru/kcfinder/upload/files/legil.pdf
- https://dunewalowipeli.weebly.com/uploads/1/3/1/8/131856746/kekiwifuxupuwawalo.pdf
- http://eminenceinc.com/userfiles/file/76698939643.pdf
- http://testplanet.nl/uploads/files/vofewesunupabasumobire.pdf
- https://finest.ccmgs.it/docs/file/gugixokiwiziz.pdf
- https://tadurefejixuset.weebly.com/uploads/1/3/4/4/134498676/655611.pdf
- http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1623719344e566---72865394680.pdf
- http://topimmigrationlawyer.org/ckfinder/userfiles/files/73544366477.pdf
- http://www.brett.ro/fisiere/file/tekimomuvexowomesedevir.pdf
- http://www.lacalzadadeoropesa.es/abm/Bibliotecas/kcfinder/upload/files/subusozuku.pdf
- https://vegas-shop.net/uploads/files/fovenadokumepezawoturu.pdf
- http://ig-einheitsloks.de/medien/file/jaxusitekumunekez.pdf
- https://gunasufipew.weebly.com/uploads/1/3/4/6/134692007/sarowep.pdf
- https://rubfila.in/files/file/66919753738.pdf
- https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/17embtfdl13t3rsfu98mnmg606/29084997089.pdf
- https://basopuseg.weebly.com/uploads/1/3/4/7/134703880/makamipisexijewaf.pdf
- http://proallprint.com/userfiles/files/72322431623.pdf
- https://sazojowob.weebly.com/uploads/1/3/4/3/134351878/6bdfe615d4.pdf
- https://bezesigut.weebly.com/uploads/1/3/2/6/132681157/4232410.pdf
- https://lenujabomixus.weebly.com/uploads/1/4/1/7/141797213/14b99bea6.pdf
- https://fogufapepupol.weebly.com/uploads/1/3/1/8/131871477/587726d0b21.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000375e7.bin15d828d80437901881366b730efd17409e8172bb1b0e4ba633dbdfa0eba25ddc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x375E7 | 11248 bytes |
font_01_sfnt_off00038fc4.bin44758c3c376ece3f373fb2cba8c8a624a392b79450ca2f8a1cd5870f2d3148ab |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x38FC4 | 17960 bytes |
font_02_sfnt_off0003bf4a.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3BF4A | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.