MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV and an ML classifier, and it contains an external URI pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to downloading a PDF. The presence of multiple embedded URLs, including one that appears to be a download link for a PDF, indicates an attempt to redirect the user to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.5166
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/award?keyword=rannar+boi+in+bengali+pdf+free+download
- http://topstudy.fun/4258962838yggyf.pdf
- http://bupro.asia/cloud_security_alliance_certification_verificationw8ou5.pdf
- http://kafidovomiguvo.mywebcommunity.org/xurosakotanapuku.pdf
- http://lnstgramhelpcopyright.com/933111442355ahlg.pdf
- https://cdn-cms.f-static.net/uploads/4485939/normal_6047b7eb32a19.pdf
- http://bullbananavannaone.xyz/agar._io_mod_menu_apkcakmo.pdf
- http://iuts.space/buripezuwepudogasusd9wbf.pdf
- https://static.s123-cdn-static.com/uploads/4419441/normal_5fdefb268b079.pdf
- https://cdn-cms.f-static.net/uploads/4459796/normal_603bdbabdae93.pdf
- http://fogafiv.mypressonline.com/photoscape.x.pro.v2.4.1.x64__crack.rar.pdf
- http://xunarepozufuz.mygamesonline.org/can_someone_see_my_browsing_history_from_another_computer.pdf
- https://cdn-cms.f-static.net/uploads/4455196/normal_6028b2f432c4f.pdf
- https://cdn.sqhk.co/porosobof/jdjcjgz/66081048261.pdf
- https://static.s123-cdn-static.com/uploads/4464327/normal_5fe5b0a540f4f.pdf
- https://cdn.sqhk.co/juvexafi/gg7qjiO/pepopanegijenesovibawomav.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/gurafoga/woruwanezakap.pdf
- https://s3.amazonaws.com/pusolefosex/badshah_film_full_song.pdf
- https://uploads.strikinglycdn.com/files/306a77bc-d113-4323-b33d-59535254b5a5/safety_first_car_seat_forward_facing_install.pdf
- http://kopurelotalad.onlinewebshop.net/how_to_set_a_honeywell_thermostat_on_auto.pdf
- https://s3.amazonaws.com/godewumazek/nigugurukiliwedufuvovipin.pdf
- https://uploads.strikinglycdn.com/files/b52305f6-bc54-4291-99c2-e8e13f5b2fa7/kixulotewamuxaxivefuwi.pdf
- https://uploads.strikinglycdn.com/files/62dc5ced-9647-4eb0-8dc6-ff2f0ab669a0/how_do_i_cancel_my_enercare_water_heater.pdf
- https://s3.amazonaws.com/verirejon/siwewinaboxop.pdf
- https://uploads.strikinglycdn.com/files/5b2323fe-20d3-4ec5-b2b8-b4b49f2d782c/how_to_paint_a_simple_winter_scene.pdf
- https://uploads.strikinglycdn.com/files/5f26fb06-1793-4cba-bad9-cbfd0e4b3bc9/wifaf.pdf
- https://s3.amazonaws.com/zalomi/85459672412.pdf
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f087.bin93256793f3fa8411ed7c9bc5b9c545fdbb9505db9d04d39dfb5fbfa925ac964a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF087 | 5268 bytes |
font_01_sfnt_off00010294.binb3c0a537a2cfff192a3bf42f1126e8343dfbde8b42b411ab261ac84328678a5b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10294 | 13600 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.