MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to medical codes, which is a common tactic for phishing campaigns.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=icd+9+code+for+wound+infection+unspecified
- https://cdn.sqhk.co/wufaluvete/3hbbicr/sputnik_movie_2020_review.pdf
- http://zhigina.ru/67197875492vt81q.pdf
- http://jetavof.sportsontheweb.net/mechanical_drawing_symbols_chart.pdf
- https://xonokuraku.weebly.com/uploads/1/3/3/9/133988937/c9fd9f1408ff437.pdf
- http://fizebiredasibi.mypressonline.com/what_happened_to_mary_rowlandson.pdf
- https://cdn.sqhk.co/tononapiwaso/gbehKfF/top_races_at_darlington.pdf
- https://static.s123-cdn-static.com/uploads/4403805/normal_5fcb6ac3da50d.pdf
- https://gilanevevo.weebly.com/uploads/1/3/0/7/130739192/jiwiwatulebobobo.pdf
- http://springtea.space/hp_smart_printerl5dl6.pdf
- https://cdn.sqhk.co/famagafe/dggVJYZ/race_for_the_galaxy_gathering_storm_rules.pdf
- http://lamatokatov.22web.org/the_curious_baby_elephant_questions_and_answers.pdf
- http://paganel.world/1549664479461vnb.pdf
- http://mirror-x.org/pududujulcsjn2.pdf
- http://wajuxerisowo.iblogger.org/jexoxozaganasazupeped.pdf
- http://kudukudimox.sportsontheweb.net/60667767445.pdf
- https://cdn-cms.f-static.net/uploads/4392463/normal_601c03f385b46.pdf
- https://cdn.sqhk.co/zapiferufefu/omif7HV/vipofuvilitojixof.pdf
- https://cdn.sqhk.co/wefenosefob/iigjja2/jarukutowodejono.pdf
- https://cdn-cms.f-static.net/uploads/4367297/normal_604ed47b96d09.pdf
- https://static.s123-cdn-static.com/uploads/4393348/normal_5fe526a2b60fe.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://susejukeb.epizy.com/4352873022.pdf
- http://jabelakejirer.epizy.com/ground_floor_plan_of_theatre_listening_answers.pdf
- http://kimafixenij.epizy.com/how_to_connect_canon_printer_to_computer_using_wifi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e928.bine986be545d213a572de1225b0a88fe4cf600bfb65a1db3aac28f138cd46608b5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE928 | 5092 bytes |
font_01_sfnt_off0000faa4.binfbf8da51383e2eb729bda2ab76b7372169b85d69ec2fd5a1dc2caedcda7985e8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAA4 | 10056 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.