MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing or malware payload. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or credential harvesting attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=corporate+accounting+multiple+choice+questions+and+answers+pdf
- https://cdn-cms.f-static.net/uploads/4366337/normal_60215d1a50b70.pdf
- https://cdn-cms.f-static.net/uploads/4464530/normal_60391f9798eda.pdf
- https://cdn.sqhk.co/sewizefaxiki/bZRgjh3/dezefejepixuwupef.pdf
- http://pro-gram.pro/baviminib3fs7.pdf
- https://cdn.sqhk.co/dexasubu/aQ2ibgd/77341057904.pdf
- http://zebozewazogaso.scienceontheweb.net/data_analysis_with_spss_sweet.pdf
- http://raifaisentapp.online/49348046bfy4e.pdf
- https://cdn.sqhk.co/tisewesir/gfiiKiP/zazexedorevuseranufo.pdf
- http://antonioita.fun/dikatututenukorew1oz.pdf
- http://vzroslyh.net/ic-718_digital_modeswqbxh.pdf
- http://liberum.sportsontheweb.net/84253005342.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fizifar.epizy.com/zepumaganinejitalepowe.pdf
- http://vexabimumemig.atwebpages.com/banking_terms_full_form.pdf
- https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_3d82084267f549edb6b12b6b165bfe60.pdf?index=true
- https://ac911ccd-a574-46a9-bbb3-57bb927ff796.filesusr.com/ugd/2735c9_f36ef9c544a941e7ba21b15e8c69aa54.pdf?index=true
- http://sonexononabon.epizy.com/how_much_is_a_2016_lexus_rx_350_worth.pdf
- https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_06fc9bec55484236a0154172a1b816b7.pdf?index=true
- https://0c17d2ad-06a2-4efd-9128-26148cac6670.filesusr.com/ugd/44320b_200d12855a97461e9fe9a1a445f03184.pdf?index=true
- http://zezatavaveb.epizy.com/pirates_of_caribbean_2_filmyzilla.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef47.bin60fb81bcd6ad7f44517c3fda407d12d5249488a97c6881dabc80f2bec5e21a0d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF47 | 5692 bytes |
font_01_sfnt_off00010276.binb492ff60b2b57796eacc2df3d1e8dce011af1d3cd976d9962c10079b970289a0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10276 | 11380 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.