MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as a malicious PDF by ClamAV and a machine learning classifier. It contains an embedded URL pointing to a suspicious domain, likely intended for phishing or malware distribution. The PDF structure and embedded content suggest an attempt to disguise malicious activity, possibly related to a fake product manual or support lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/wix?keyword=liftmaster+41a4252-7c+remote
- https://cdn-cms.f-static.net/uploads/4365608/normal_5fe62c4f596c3.pdf
- https://static.s123-cdn-static.com/uploads/4465259/normal_5fd051d2d1493.pdf
- https://cdn-cms.f-static.net/uploads/4495837/normal_6032a5b395b9a.pdf
- http://foyou.store/duralast_50_amp_battery_charger_and_engine_starter_manualvmdx9.pdf
- https://cdn-cms.f-static.net/uploads/4454184/normal_600dbee86f2fa.pdf
- https://cdn-cms.f-static.net/uploads/4366980/normal_604687ee7d9c3.pdf
- http://zespodsvetkoy.site/fezulajetujowajizabanasxolew.pdf
- https://static.s123-cdn-static.com/uploads/4462344/normal_5ffd245a348ac.pdf
- http://sfhgfje5df.xyz/876109038211ns0q.pdf
- https://cdn-cms.f-static.net/uploads/4469841/normal_602039c0567fb.pdf
- http://onkoprofi.ru/1996_ford_555d_backhoe_for_saleyubui.pdf
- https://static.s123-cdn-static.com/uploads/4369494/normal_5ff94bc1b36e6.pdf
- https://static.s123-cdn-static.com/uploads/4416494/normal_5fe264d2dae44.pdf
- http://ihsteam.ru/lee_child_jack_reacher_books_in_date_order6rt07.pdf
- https://static.s123-cdn-static.com/uploads/4416786/normal_5fdd43981fa02.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/bfa32935-90c5-48d7-b102-98b7f4777aaa/kaxorarulolowujimi.pdf
- https://uploads.strikinglycdn.com/files/37fb2310-cce4-4a9f-ba9c-fc70f5b947a1/68926561097.pdf
- https://uploads.strikinglycdn.com/files/f5a4d0f5-5c0b-4589-830c-e988eaacd807/what_is_the_story_dark_they_were_and_golden_eyed_about.pdf
- https://uploads.strikinglycdn.com/files/126957c2-dfde-4b9b-9b20-222911bb5fd5/how_to_teach_a_child_listening_skills.pdf
- https://uploads.strikinglycdn.com/files/27e2815e-2441-4b4a-a69e-bffde3132d2b/dunkin_donuts_chocolate_covered_donut_calories.pdf
- https://uploads.strikinglycdn.com/files/e9c0f079-321a-47f2-980f-44e2b1c17be1/tosotukoluge.pdf
- https://uploads.strikinglycdn.com/files/d608d359-2c4a-49dd-ada4-848cf8941dce/nibusogejudekozitenaweta.pdf
- https://uploads.strikinglycdn.com/files/5e301da7-ffda-455e-a04d-aaa53a54df94/57947909917.pdf
- https://uploads.strikinglycdn.com/files/22c2329e-e199-4341-9773-34c7c3b6615c/how_to_use_quizlet_app_on_iphone.pdf
- https://uploads.strikinglycdn.com/files/5c178af9-f975-4abe-81c6-fbd13237ef5c/80663542800.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002336c.binfbb6ae9184e05b7592e1ef07e09007a7cac249684682242a1567fcf206b8fcba |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2336C | 5444 bytes |
font_01_sfnt_off000245fc.binbd1ea3a02179e3f2662a9d0ca28aa92441f3fe1549f5e991412e568dcb328d0d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x245FC | 11600 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.