MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a heuristic firing for an external URI, specifically pointing to 'https://xezojetit.ru/123?utm_term=where+is+the+closest+dunkin+donuts+to+me'. This URL, combined with the document body text, suggests a phishing attempt disguised as a search query to trick the user into clicking the malicious link. ClamAV detection further supports the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/123?utm_term=where+is+the+closest+dunkin+donuts+to+me
- https://cdn.sqhk.co/juxefirapuf/ia9iahc/personal_obstacles_examples.pdf
- http://lilubaxubaxulu.sportsontheweb.net/private_peaceful_best_quotes.pdf
- https://cdn.sqhk.co/xudadidi/qegf7ic/red_robin_order_online_coupon_code.pdf
- https://cdn.sqhk.co/xolizoxime/ccifji7/pazafub.pdf
- http://madoxorijegobe.sportsontheweb.net/high-probability_trading_setups_a_chartists_guide_to_real-time_trading.pdf
- https://dobuwejakunarek.weebly.com/uploads/1/3/4/7/134772316/4359869.pdf
- http://helplnstagramcontact5087423.com/wahoo_elemnt_bolt_user_guideht4ps.pdf
- https://xuwosanilenerev.weebly.com/uploads/1/3/4/9/134900173/3719716.pdf
- http://phtech.site/zombie_hunter_evil_sniper_mod_apkaic7l.pdf
- https://kojegowi.weebly.com/uploads/1/3/4/6/134685768/0ad10852c.pdf
- http://lnstagramverifiedbadge-media.com/kapalaposagifdc.pdf
- http://zupezejukiselu.22web.org/tuworilezimulofatu.pdf
- https://gedibaforajipet.weebly.com/uploads/1/3/0/8/130874683/xoregadipeg.pdf
- https://cdn.sqhk.co/fedelubu/jjhhDyJ/novebumenogarowa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nagivozuzosawax.rf.gd/57276110858.pdf
- https://s3.amazonaws.com/rolefosiju/4478474766.pdf
- http://jupetovujek.epizy.com/64403411270.pdf
- https://s3.amazonaws.com/gomaxod/ponte_retificadora_kbpc5010_datasheet.pdf
- https://s3.amazonaws.com/kulinisokakewi/bodaton.pdf
- https://s3.amazonaws.com/megelugik/49409053746.pdf
- http://gigitepusiligo.epizy.com/90180412347.pdf
- https://s3.amazonaws.com/lixuduwonifa/92281737451.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000caa1.bin2f7786d5b1fe27a58e3f492340a7878483ee3a546029ac321515d77a3145e001 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCAA1 | 5048 bytes |
font_01_sfnt_off0000dbaf.bin0fc5e3c285c78bc2404f2c77aa470d5a0ddb0c94a01e13ce0aa270ecba9535cd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDBAF | 10368 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.