MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The file is a PDF document that contains multiple embedded URLs, one of which is highlighted as a primary target for download. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing or trojan delivery mechanism. The presence of a visual download button heuristic further supports the attack pattern of luring users to download a payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.7107
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lazav.co.za/XSRYdR1H?utm_term=ecg+made+easy+book+pdf+files+download+full+version
- https://paymentor.nl/uploads/file/lodes.pdf
- http://analizmatbaa.com/panel/kcfinder/upload/files/52260360121.pdf
- https://pawigesi.weebly.com/uploads/1/3/5/3/135389203/7778439.pdf
- https://bokakuvuzojoji.weebly.com/uploads/1/3/4/3/134351808/nurudarejid.pdf
- http://dogwarts.ru/sites/default/files/file/20345294815.pdf
- http://noithatxuanhoa11.com/upload/files/kodelijowugebelabana.pdf
- http://autolubitel-irk.ru/userfiles/file/54370438568.pdf
- https://zegirapenutiv.weebly.com/uploads/1/3/4/3/134393596/9612c547103cf.pdf
- https://jolejijiwunepa.weebly.com/uploads/1/3/5/3/135334118/3094624.pdf
- https://moramiwise.weebly.com/uploads/1/3/4/7/134736235/628bf28e6415bb.pdf
- https://gawugabel.weebly.com/uploads/1/3/4/3/134361726/9774360.pdf
- https://jameropavide.weebly.com/uploads/1/3/4/6/134699307/toziw.pdf
- http://bldc.aspbae.org/userfiles/file/fezapositatem.pdf
- https://zasigusedorel.weebly.com/uploads/1/3/4/3/134386673/vowuguz.pdf
- http://kientrucmoi.com.vn/admin/kcfinder/upload/files/vuzupopamiwisenozuzelu.pdf
- https://diphong.com/uploads/35396786448.pdf
- https://www.stnedu.com/ckfinder/upload/files/vomotevapajalilaban.pdf
- https://nirejabepifu.weebly.com/uploads/1/3/4/2/134266024/volovepikuj-vokakabatagobuw-zakasunokexaju.pdf
- https://songhong-thudo.com/img/files/44153602804.pdf
- https://boxilopo.weebly.com/uploads/1/4/1/5/141515724/valamesovalusofasu.pdf
- http://salonlisien.com/upload/files/nitexedifas.pdf
- https://pelixenebedevo.weebly.com/uploads/1/3/4/3/134338689/getiwoxugeti_rugadi.pdf
- https://jawetixadal.weebly.com/uploads/1/3/1/6/131606755/gemogal.pdf
- http://hammaddedunyasi.com/panel/kcfinder/upload/files/24023196346.pdf
- https://nonejekorozu.weebly.com/uploads/1/3/4/1/134108542/sefekozupowe-tivibomuwupenat.pdf
- http://zimmerei-possert.at/vixifibi.pdf
- https://kattliv.com/kattliv/admin/userfiles/file/23734091788.pdf
- https://calendarsunrooms.com/userfiles/files/nibebuwozujogobedaxerav.pdf
- https://kujulofemalil.weebly.com/uploads/1/4/1/3/141364464/13696ed03a.pdf
- https://kaxemesotom.weebly.com/uploads/1/3/4/7/134732336/5812142.pdf
- https://zirivuso.weebly.com/uploads/1/3/1/1/131164479/68ad20.pdf
- http://nandishoverseas.com/UserFiles/File/zatapuvudonediz.pdf
- http://anonelectronics.com/admin/fckeditor/editor/filemanager/connectors/php/upload_jpg/file/202203010003459144.pdf
- https://kunepupavebi.weebly.com/uploads/1/3/4/0/134095879/9046069.pdf
- http://capitolmetrophysicaltherapy.com/files/files/vemebotobivonan.pdf
- http://xn----7sbabjkhbzbqti4a3apfmdd2s4b.xn--p1ai/ckfinder/userfiles/files/93470875054.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002dd94.bineaed805f5f721161103189fe4fa2bd1984a94cf70f4d2ea7862fa9cdcf236634 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2DD94 | 17204 bytes |
font_01_sfnt_off00030a78.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x30A78 | 16792 bytes |
font_02_sfnt_off00032290.bin9d2a235cdab094b12d11f9869e2bd24bbd72e662ac7240c0e81438d36dd50ee4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x32290 | 11444 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.