MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The file is a PDF containing multiple embedded URLs, one of which, https://lazav.co.za/XSRYdR1H, is flagged as suspicious and likely leads to a phishing or malware distribution site. ClamAV detection and ML classification further support its malicious nature. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external links strongly suggests a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.6424
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lazav.co.za/XSRYdR1H?utm_term=worksheet+dna+rna+and+protein+synthesis+answer+key+free+online+courses
- https://n-tlg.com/files/file/najixuzipenefupovinubo.pdf
- https://koramuxojenaxer.weebly.com/uploads/1/3/4/7/134701110/gofaja_xijifov.pdf
- https://callmarkinvestments.fortunekenya.com/callmark/files/sajarodi.pdf
- http://alvit-bk.ru/userfiles/file/gugabafapijewun.pdf
- https://polujififodujan.weebly.com/uploads/1/3/4/5/134512681/zosejilukiw.pdf
- http://tiszaladany.hu/upload/file/14480009251.pdf
- https://nasoxatexiwek.weebly.com/uploads/1/3/0/7/130739087/livoridiladimiper.pdf
- https://gozarijaleb.weebly.com/uploads/1/3/4/3/134337750/lotoxis.pdf
- https://sokudenolojine.weebly.com/uploads/1/4/1/5/141522004/3435690.pdf
- https://kosusupexe.weebly.com/uploads/1/4/1/4/141442347/75b3dc7d5.pdf
- http://ephtour.com/FileData/ckfinder/files/20220210_06F58F73D3EC4360.pdf
- http://netpart.hu/kcfinder/upload/files/woxomurox.pdf
- https://eltonltd.ru/sites/default/files/uploads/29396612471.pdf
- https://rovewavulitomu.weebly.com/uploads/1/3/0/8/130873995/biriraf.pdf
- https://meiontravel.com/UploadFiles/file/20220202014414108.pdf
- https://jerixexi.weebly.com/uploads/1/4/1/3/141388989/fogepejedenolo_vezepogu.pdf
- https://bexudedumazises.weebly.com/uploads/1/3/1/4/131406785/2714651.pdf
- http://www.jindatunnel.com/up_files/file/pujegazaveta.pdf
- https://xevosafodom.weebly.com/uploads/1/3/4/7/134739965/b80bc7.pdf
- https://nghiepvu.udicmanpower.vn/uploads/news_file/54288823161.pdf
- https://roxomutina.weebly.com/uploads/1/3/4/6/134663133/lebimow.pdf
- https://apapunada.com/contents/files/76496277078.pdf
- http://nesthomes.in/userfiles/file/fakezaz.pdf
- https://kusevekusaf.weebly.com/uploads/1/4/1/3/141348410/bixuvikeleji.pdf
- https://takogazaka.weebly.com/uploads/1/3/4/0/134017011/toxifububolamemobum.pdf
- https://nogonosexenepe.weebly.com/uploads/1/3/4/6/134674491/pizafo-lajef-sebupenetene-tosiwisa.pdf
- https://kudaxemukuwofi.weebly.com/uploads/1/3/4/6/134691428/4969460.pdf
- http://ricettebiagi.it/uploads/assets/file/8211835505.pdf
- https://wupixizot.weebly.com/uploads/1/3/5/3/135398135/mosefet.pdf
- https://wobipuferuki.weebly.com/uploads/1/4/1/2/141258080/kuximurusuwe_xaloduxo_debexokabi_bokatabexobisov.pdf
- http://www.sfainternational.pk/assets/ckeditor/kcfinder/upload/files/pexokarusarugimawon.pdf
- https://esperanzadeavila.com/fotos/file/67880019939.pdf
- http://skogsformedling.se/bilder_umeny/File/69450289238.pdf
- https://harley.dataroom.tw/upload/files/vogulinob.pdf
- https://bafikesixetiv.weebly.com/uploads/1/3/4/5/134506736/43429c.pdf
- https://gikotibosad.weebly.com/uploads/1/3/4/3/134332820/b7aa460.pdf
- http://sangiaodichlaocai.com/upload/image/file/tetowuzaza.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00045b5f.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45B5F | 16792 bytes |
font_01_sfnt_off00047376.bin9a24eccf838c516b1805823ff45536ef079afe4e048788851ef4ee45b4bd1831 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x47376 | 11100 bytes |
font_02_sfnt_off00048d63.bin3a25442d4ab84714c75c9e0ea62bb3b37433cb7585fdc97a93e89ff45b3ba5ad |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x48D63 | 18324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.