MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified as a phishing or malware distribution attempt by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to 'CPR guidelines 2020 pdf', likely intended to trick the user into downloading a malicious payload from the linked URL. No scripts were extracted, but the presence of external URIs and the ML detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/award?keyword=cpr+guidelines+2020+pdf PDF link annotation
- http://insurancesouk.com/how_long_does_ti_ba_ii_plus_battery_last2qkg4.pdfIn PDF document text
- http://axecheat9.xyz/2082442657jlqp0.pdfIn PDF document text
- http://podeves.xyz/mu_cv_ting_vit_hayl514x.pdfIn PDF document text
- http://classkaod.ru/what_level_is_nate_the_greatdw52g.pdfIn PDF document text
- http://table-wait.com/reduce_to_its_simplest_form_synonymw8zs1.pdfIn PDF document text
- http://sanatoriy-izumrudny.ru/what_is_les_misrables2zbyw.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/6374ba39-8220-4522-9fba-a9052571630f/81887268382.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/533ccc39-5fdc-49ec-b156-593cc0f918a5/black_and_decker_18v_battery_charger_replacement.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa052170-ee8c-469d-9ccd-ece0bfe31e91/malarow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/460398c2-dc1b-4ff2-b2a2-f8989afcaa75/dimelivupoxositi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f72a5616-af79-4a06-9d52-91ee23786ce1/93131029971.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0c9b8aa7-a9a5-4e32-a031-eb0a26527095/words_have_power_read_a_banned_book.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7bd814e4-af9c-484c-9429-42eb32ba08ca/the_road_movie_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69d2e1de-0fde-4653-9f9d-49121879c8b1/what_kind_of_oil_does_a_subaru_pressure_washer_use.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9118f46-4f33-46a7-8764-b4cb24c13629/dutizabulodajosikupiti.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/33ceecd3-c747-460f-85ef-f33014593355/sony_str-dn840_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fdcd9d85-32dc-46f4-b432-3229c952dc17/bonugaxutorisivegat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d929e0c0-c4f9-44c5-b24a-0669a9565bc0/save_the_cat_beat_sheet_movie_example.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/271d8d16-1be6-48ab-80b6-030dff888fa9/75372204070.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b55d882-bcd1-448e-9080-49739742108a/space_place_and_gender_identities_develop_pre-600_bce.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1ff78df-7d0f-417e-a93b-50f3805846d8/berenstain_bears_books_collection.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b1f3c890-52e9-409a-b23c-28aee5899063/casio_wk_220_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a88b9af-67b2-46a9-9a3b-9a56386fa831/is_fossil_watch_waterproof.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001bbd3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BBD3 | 4988 bytes |
SHA-256: d83658f2dfde8af205b459c5bef86e20402dfc2cd1577d6c46be2bd887eeb5de |
|||
font_01_sfnt_off0001ccd3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1CCD3 | 12060 bytes |
SHA-256: 2cc00786cc3bfc48b8c0ead7a19f7a2ad877b4162812952b3e9a79d5fbe942b7 |
|||
font_02_sfnt_off0001f4d1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1F4D1 | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.