MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, exhibiting characteristics of an advance-fee scam. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. No scripts were extracted, but the overall structure and heuristic firings strongly suggest a phishing or scam attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=cara+hard+reset+printer+epson+l360
- https://cdn-cms.f-static.net/uploads/4424672/normal_6047eca2b50d9.pdf
- https://cdn-cms.f-static.net/uploads/4367921/normal_605bf24ccab31.pdf
- https://cdn-cms.f-static.net/uploads/4479226/normal_60471ee9ddc17.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jebokizez/50843009333.pdf
- https://uploads.strikinglycdn.com/files/0e6c8ed5-1dea-4dda-91bd-27bb6a1381a1/whats_the_difference_between_power_probe_3_and_4.pdf
- https://uploads.strikinglycdn.com/files/671beb23-d4fb-4065-acca-2b67ccd7ef0a/zyxel_pk5001z_custom_firmware.pdf
- https://s3.amazonaws.com/vonusirukete/95146565948.pdf
- https://uploads.strikinglycdn.com/files/2bc2fec4-aaac-4e97-b0ed-4da092d4a725/premam_malayalam_full_movie_download_link.pdf
- https://uploads.strikinglycdn.com/files/71a714db-be35-4ae8-b196-f193e2fb811c/troy_bilt_tb240_oil_change.pdf
- https://uploads.strikinglycdn.com/files/8e67feed-63f5-4dc5-bbdb-e2ff2d871dc1/siwavevasabimawopezasoxib.pdf
- https://uploads.strikinglycdn.com/files/8400766f-e37f-4a51-b214-84bc599af3a8/fativaxalevonenufaxis.pdf
- https://uploads.strikinglycdn.com/files/70db2db6-bd52-4679-8ff1-ccba4d83a422/infinite_self_stuart_wilde_free.pdf
- https://uploads.strikinglycdn.com/files/9afd3a8a-8945-4c62-9d22-ff1c54b0880e/977127859.pdf
- https://s3.amazonaws.com/wetevali/reniwanozilugel.pdf
- https://s3.amazonaws.com/jawusawar/performance_review_feedback_for_manager.pdf
- https://s3.amazonaws.com/sajezife/discounted_cash_flow_excel_format.pdf
- https://uploads.strikinglycdn.com/files/8f96d542-5180-4c18-a52d-7f792a9b69e0/how_to_use_a_kangertech_evod.pdf
- https://uploads.strikinglycdn.com/files/677b0247-cc1f-4b5f-b899-a1f0a38529bf/what_surahs_are_in_juz_26.pdf
- https://s3.amazonaws.com/wibadinavosunom/autodesk_sketchbook_pro_7_manual.pdf
- https://s3.amazonaws.com/vezumobigodub/boaters_test_florida_answers.pdf
- https://uploads.strikinglycdn.com/files/e8a635d4-92d0-4010-811f-d76ff4b5a222/medialink_router_support.pdf
- https://uploads.strikinglycdn.com/files/1880dbdd-519b-4c8a-88a6-9f7038fcf255/38666061658.pdf
- https://s3.amazonaws.com/pipaneku/how_to_use_fluke_324_clamp_meter.pdf
- https://uploads.strikinglycdn.com/files/4b4190c9-3960-49fc-b0f7-4d47b4588cce/96843606386.pdf
- https://uploads.strikinglycdn.com/files/939434ae-d200-467f-843a-2c5d2fe83376/59628035140.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010cc6.binfe5c94ed8dda8a83b8086a1c2f300e0ac5818dff7601c00ecd407c8ae2bd2c10 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CC6 | 5412 bytes |
font_01_sfnt_off00011f1e.bin8a4e717bb9d367ddc5a660f3730161be089964202dd3f1736b68d699c96a927b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F1E | 11388 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.