MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL that, when clicked, leads to a domain associated with malicious activity. The document body, though partially corrupted, suggests a lure related to technical support for Xfinity remotes, a common phishing pretext.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=what+to+do+when+xfinity+remote+won%2527t+change+channels
- https://cdn-cms.f-static.net/uploads/4379603/normal_601321f02a6dd.pdf
- https://cdn-cms.f-static.net/uploads/4377931/normal_6020bc05df1ca.pdf
- https://static.s123-cdn-static.com/uploads/4381973/normal_5ffbb53ea3009.pdf
- https://static.s123-cdn-static.com/uploads/4388062/normal_5fc7a373d1f90.pdf
- https://cdn-cms.f-static.net/uploads/4416935/normal_6052b019e02b4.pdf
- https://static.s123-cdn-static.com/uploads/4370560/normal_5fc926175feaa.pdf
- https://static.s123-cdn-static.com/uploads/4445550/normal_5fcc8d512dc05.pdf
- https://cdn-cms.f-static.net/uploads/4490122/normal_601ba7a8679c7.pdf
- https://cdn-cms.f-static.net/uploads/4413243/normal_5fd1e0f2c24f2.pdf
- https://static.s123-cdn-static.com/uploads/4487424/normal_5fcae4c0ed886.pdf
- https://static.s123-cdn-static.com/uploads/4367644/normal_5fe08abdc2fb7.pdf
- https://static.s123-cdn-static.com/uploads/4387825/normal_5fcc643b7640b.pdf
- https://cdn-cms.f-static.net/uploads/4385230/normal_605d7b21a3e04.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/fe6b9404-fd12-41d0-96e9-60dbdbbeaa25/oster_regency_kitchen_center_mixing_bowls.pdf
- https://uploads.strikinglycdn.com/files/1b44b0c5-3417-44b0-9868-13060c71ed37/logo_modernism_book_free.pdf
- https://uploads.strikinglycdn.com/files/2de243eb-859c-4d47-9941-edbe8110e4d4/how_to_measure_training_effectiveness_metrics.pdf
- https://uploads.strikinglycdn.com/files/f4811fa8-1e26-4c32-a1bc-c4c6a5e79ad4/tawilotilotaxozu.pdf
- https://uploads.strikinglycdn.com/files/b102e7a4-8815-458e-8021-4299d7f95200/xazuferito.pdf
- https://uploads.strikinglycdn.com/files/6ea051c4-3ced-4b21-8290-90bca6d15a7c/what_was_the_95_theses_written_by_martin_luther.pdf
- https://uploads.strikinglycdn.com/files/2860e13d-5edc-45e6-a470-9f42242808c8/71052032072.pdf
- https://uploads.strikinglycdn.com/files/07c84472-1b2d-41ac-9c18-9a02d080454c/jaroslav_seifert_maminka_kniha.pdf
- https://uploads.strikinglycdn.com/files/869e26d9-2f8e-4836-a63f-5830dedcc52f/xivenuvedaruxisuw.pdf
- https://uploads.strikinglycdn.com/files/9bcc5648-cbe8-4395-9b8e-6f6ed5fdb43b/private_practice_cast_season_3_episode_16.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f43c.bind314629751f5331be3bebac0110466c8698364b3a6190b716594f91afa44bbf7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF43C | 5744 bytes |
font_01_sfnt_off000107cd.bin80cd51407b8c1ff4c63a5ad99549ff91e850d6c8be9e26dc5ef39cb47255de1b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107CD | 10932 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.