MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains embedded text that appears to be an answer key for a "CSI web adventures case 1", likely a lure to entice users to click on a malicious URL. The ML classifier and ClamAV detection strongly indicate maliciousness. The primary IOC is the external URI pointing to a suspicious domain, which is likely used to host a secondary payload or phishing content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/aws?utm_term=csi+web+adventures+answer+key+case+1
- http://usechambre.xyz/6547863058101xwq.pdf
- http://cybety.xyz/pimoledera9h.pdf
- http://subuxiwubemew.getenjoyment.net/son_algunos_ejemplos_de_medios_de_comunicacin_masiva.pdf
- http://potenciy.xyz/why_was_government_of_india_act_1935_introduced0n2j6.pdf
- http://suporefebakibur.mygamesonline.org/what_are_the_components_of_a_news_story.pdf
- http://zaxevef.getenjoyment.net/57408579397.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lodazojamuva/novinifolabeni.pdf
- https://2863666b-9d79-467d-9aad-9eeb6dafbdf2.filesusr.com/ugd/6ee3eb_3ccc9be9c7af403c8f63b082ba3400bf.pdf?index=true
- https://4993f9ff-345c-4c03-a8ec-d4f8dac664d6.filesusr.com/ugd/debbe1_515f70b5c9214e65b51accaaa434f4ea.pdf?index=true
- http://kosezofejesuxef.atwebpages.com/95037311235.pdf
- https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_637c2f8d810b4751a77f26b79685a13b.pdf?index=true
- https://1cf095b7-1d29-4152-b82c-7733cf7ba0c7.filesusr.com/ugd/c1de29_cbe7ae88a2e74112b73fcf966dfc7154.pdf?index=true
- https://s3.amazonaws.com/gurafoga/69676496353.pdf
- http://rofuvawitarul.atwebpages.com/dark_souls_3_save_game_editor_pc.pdf
- https://uploads.strikinglycdn.com/files/c88f9009-4178-4e86-82ef-08f863dfbd67/fallout_4_script_extender_vr.pdf
- https://uploads.strikinglycdn.com/files/e2907bd5-4134-45ce-9f54-87f05954faeb/60689552877.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d735.bincc3e728673ea9e7516e07ddfde3c9729372839bcc545905f0bce3ebd24c5c5b7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD735 | 5316 bytes |
font_01_sfnt_off0000e97a.binace45d16d7cf6a7db680250eef9dd9f4b2f22c2fc01ab45c93c8c32b02c28c60 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE97A | 11124 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.