MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of an external URI points towards a phishing or malware distribution attempt. No scripts were extracted, but the overall structure and heuristic firings indicate a malicious intent to redirect users to a potentially harmful website.
Machine Learning
- Nyx PDF Classifier malicious score 0.7536
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/award?keyword=pdf+bhaktamar+stotra
- https://ruworelolovifuf.weebly.com/uploads/1/3/4/4/134462917/20606edf26bac.pdf
- https://cdn-cms.f-static.net/uploads/4469128/normal_600b6a5da42dc.pdf
- http://bettyloustintruckbbq.com/59207099938fynl6.pdf
- http://prizinsta24.space/how_to_fake_a_mailing_addressex9ng.pdf
- http://24goodstore.site/how_to_do_an_absolute_value_inequalityg3ql0.pdf
- http://drive4mclaneeffingham.com/22023261980dwbsp.pdf
- https://cdn-cms.f-static.net/uploads/4386834/normal_600b9e2cf05f5.pdf
- https://static.s123-cdn-static.com/uploads/4446029/normal_600601faa122f.pdf
- http://zijilip.iblogger.org/chaupai_sahib_in_english.pdf
- https://vedaputenada.weebly.com/uploads/1/3/5/3/135318287/lusovojig_vawikinumaxer.pdf
- http://neviresutuv.iblogger.org/gukerarav.pdf
- https://static.s123-cdn-static.com/uploads/4465701/normal_5fe02e7bc7042.pdf
- https://cdn-cms.f-static.net/uploads/4369514/normal_6050998a1bfb8.pdf
- https://cdn-cms.f-static.net/uploads/4415944/normal_6058be4ab4279.pdf
- https://static.s123-cdn-static.com/uploads/4392457/normal_5fcf7f285c780.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://noxoposuxasife.rf.gd/33150506256.pdf
- https://uploads.strikinglycdn.com/files/5c1cf298-87aa-467d-b371-1723fe204648/pitekolekofenorudowenokas.pdf
- http://tuserigetov.rf.gd/automotive_industry_definition.pdf
- http://tejojode.rf.gd/63823703105.pdf
- https://uploads.strikinglycdn.com/files/cd74c4e3-1b51-42d2-b34a-c4e75478e5cf/18672325038.pdf
- https://uploads.strikinglycdn.com/files/0394ded3-4283-4815-83d6-c65455386bc9/traction_how_any_startup_can_achieve_explosive_customer_growth.pdf
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000102fe.binc515264fb4e1b6194d80319e099618b07d79de5ea06b8f5f7324288b4720e0d4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102FE | 5320 bytes |
font_01_sfnt_off000114e6.bin6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114E6 | 3720 bytes |
font_02_sfnt_off00012049.bina0b46cdb05acfa97af9d6d3d1a5726be4a8747d9c72a5a0f25647cc7b23fe225 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12049 | 10852 bytes |
font_03_sfnt_off0001459d.bin461a1578f80084b2f2ca998a6e716936969cc9b33b2976d66eaaa57f6abee57a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1459D | 16172 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.