MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs, some of which are marked as unknown reputation, suggests a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URIs point towards a spearphishing attachment attack vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.osgeurope.com/sites/osg-corporate.dev/files/webform/35757612566.pdf
- https://www.osgeurope.com/sites/osg-corporate.dev/files/webform/10654010608.pdf
- http://www.sumnercountyhospital.org/sites/default/files/webform/sinuwoxifazuroli.pdf
- http://russian-ice-spb.ru/sites/default/files/webform/files/fapulewamekunasu.pdf
- http://pilgrimland.com/sites/default/files/webform/resume-uploads/64296936159.pdf
- https://www.termis.org/system/files/webform/vomijalikuwukilowerosi.pdf
- https://www.natsihwa.org.au/sites/default/files/webform/tesogiruzan.pdf
- http://seiary.com/sites/default/files/webform/rec/55418097166.pdf
- https://www.cdcplumbing.com/sites/default/files/webform/contact-us/sawifujemenolezaf.pdf
- https://natsihwa.org.au/sites/default/files/webform/degajakuko.pdf
- http://www.muttypawsacademy.com/sites/default/files/webform/vaccines/nojezajewi.pdf
- https://ambrose.edu/sites/default/files/webform/11118021720.pdf
- https://extranet.blanchisserie-toulousaine-de-sante.com/sites/extranet.blanchisserie-toulousaine-de-sante.com/files/documents/justificatifs/29410319198.pdf
- http://www.pbttphtk.gov.my/sites/default/files/webform/88462653206.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=aprendizaje+entre+pares
- https://community.princeton.edu/system/files/webform/fivedexexefo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ca9b.bin130c9b1c4fad75f6feca9921d42db34f1cacd1486202f21ff1ca409403dac057 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCA9B | 5036 bytes |
font_01_sfnt_off0000dbd3.bine5cabb8a6b180bf8eda2d5c067bf1052d675d1e33ab0eb9d6c44571b5de3ff38 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDBD3 | 11992 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.