MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain associated with malware distribution, specifically referencing 'minergate apk latest version', suggesting a lure for potentially unwanted software or a phishing attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9905
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/wix?keyword=minergate+apk+latest+version
- https://cdn.sqhk.co/zodozane/P3jdjfu/lunikuguruwukifurejaza.pdf
- https://cdn.sqhk.co/dupabeket/jf1LKC9/platform_bed_plans_full.pdf
- https://cdn.sqhk.co/tirinakiweda/NURhheG/assistant_executive_director_definition.pdf
- http://jisijopimif.66ghz.com/inspector_general_s_report_2019.pdf
- https://cdn.sqhk.co/xezalagefog/6higiZb/free_bootstrap_checkout_page_template.pdf
- https://cdn.sqhk.co/sexuzoropa/gsiegjT/95263595957.pdf
- http://zasoremejoka.iblogger.org/analise_fundamentalista_forex.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fedorahosted.org/lohit
- http://povasapodojika.epizy.com/nukedekawusipuvuviladuzit.pdf
- http://bupixifebinare.epizy.com/liloxafit.pdf
- https://uploads.strikinglycdn.com/files/6bccb78b-8f96-495b-b61d-e76654a88b1b/gate_2016_ece_marks_vs_rank.pdf
- https://uploads.strikinglycdn.com/files/63653230-448f-4f3d-8c47-05cec090ae65/purposes_of_law_in_society.pdf
- https://uploads.strikinglycdn.com/files/0ebb3313-4148-434b-829e-c854779b62fd/a1c_compared_to_blood_sugar_chart.pdf
- https://uploads.strikinglycdn.com/files/59e855f3-0505-410f-a50e-d14c2045b077/captivity_of_mary_rowlandson_summary.pdf
- https://uploads.strikinglycdn.com/files/f5bf96ca-01dc-458f-be17-6057059b9964/neket.pdf
- https://uploads.strikinglycdn.com/files/8dc41582-3c2c-47d6-a9cc-6a16496d1b53/esv_audio_bible_dramatized.pdf
- https://s3.amazonaws.com/xeponodij/sheet_metal_bead_roller_dies.pdf
- https://uploads.strikinglycdn.com/files/19b22e8b-a0e0-48f7-b2db-0a3faef75639/fiwuporutonafom.pdf
- https://s3.amazonaws.com/guvovigo/37539939335.pdf
- https://uploads.strikinglycdn.com/files/fdee654c-8ed2-445f-9fbf-58612ba1a6b3/kixur.pdf
- http://viwukapatajomi.rf.gd/bar_bar_din_ye_aaye_remix.pdf
- https://s3.amazonaws.com/vesubodufisi/88255366062.pdf
- https://s3.amazonaws.com/zijivevip/69802311926.pdf
- https://uploads.strikinglycdn.com/files/e146c5f5-3b2e-4379-bd71-1c5299b44ae0/how_old_does_a_dachshund_have_to_be_to_breed.pdf
- https://uploads.strikinglycdn.com/files/05f50e85-357a-4364-8772-b280d6490436/41631088441.pdf
- https://uploads.strikinglycdn.com/files/66cf2e62-03d0-4a4b-a53b-9d1348ec0539/59218577722.pdf
- https://s3.amazonaws.com/suzujewa/south_america_rivers_map.pdf
- https://uploads.strikinglycdn.com/files/a6fa069c-9c4a-45d4-8aa6-52315155531c/79807416087.pdf
- https://uploads.strikinglycdn.com/files/2350fb3c-ebf8-4304-8c44-704ae7916642/hitchhikers_guide_to_the_galaxy_movie.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1fe.bin629123bfde0685c5f69bbdd27ec008bde0224d5c30af1dabb990f6ee33ea778e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1FE | 6440 bytes |
font_01_sfnt_off000101f2.bin033a03925a6b66c5d00f429a2d0d30ad9ce1d536815d8c0be00d614b79af8056 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101F2 | 5116 bytes |
font_02_sfnt_off00011382.binf2070dbeeded4f9723bf2407838999f2feb9178dfb401584af0ef166511cd7e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11382 | 10696 bytes |
font_03_sfnt_off0001386e.bin354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1386E | 16036 bytes |
font_04_sfnt_off00014d12.binefa28d4d6f970fe7611181c2d15a020f2df49775abfc4461c750cfa780c37718 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14D12 | 3524 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.