MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest a phishing or credential harvesting attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=the+tao+of+pooh+chapter+3+summary
- http://am-sound.ru/13321177917n45o6.pdf
- http://bilkan.fun/80013917988gggnq.pdf
- https://cdn.sqhk.co/kevovevude/egdmgdT/affirmation_definition_shifting.pdf
- https://cdn.sqhk.co/zonigita/dhihgnT/jamolasino.pdf
- https://cdn.sqhk.co/letarezetap/glkiijh/37947139217.pdf
- http://normab-id.com/14312115386vzu1m.pdf
- https://cdn.sqhk.co/letarezetap/qCFbfIF/free_funeral_program_brochure_psd_template.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/625a909e-ce66-4ef0-9116-4f392514a268/books_to_read_to_your_baby_girl.pdf
- http://pidawuz.epizy.com/84129966313.pdf
- https://uploads.strikinglycdn.com/files/903d9d74-1eb5-4632-89b8-cdbcf28bf438/85294094629.pdf
- https://uploads.strikinglycdn.com/files/29a35cb0-dbc3-4320-be3f-a5167289ad95/how_to_adjust_bluetooth_volume_on_samsung_tv.pdf
- http://vozerurivuboki.epizy.com/obligationenrecht_aktiengesellschaft.pdf
- https://uploads.strikinglycdn.com/files/4978ec85-04e8-4b6d-88d5-bdaab60014ef/79790213171.pdf
- https://uploads.strikinglycdn.com/files/80e0b313-37b4-4eda-995a-1d8f3de71ca0/black_boy_hairstyles_with_hair.pdf
- https://uploads.strikinglycdn.com/files/131e7c73-44cc-4213-89da-f729f435c747/best_bosch_100_series_dishwasher.pdf
- https://uploads.strikinglycdn.com/files/c83151c4-e211-4aa0-992d-142ea7422c36/bible_verses_when_you_feel_lonely.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fe84.bin32f7a77883be3c6b4ac08829cccb300b197b5e30fa02b303463571c5d53c993c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE84 | 5440 bytes |
font_01_sfnt_off000110e4.bin753a7cb864ec46e0b27a81c1d4eac303c51de9e4891bcdc23782a076873a4d11 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x110E4 | 10832 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.