MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains multiple embedded URLs, one of which is directly referenced by a heuristic as an external URI. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, appears to be a lure related to a manual search, suggesting a phishing or social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/wix?keyword=magnavox+mc345+manual
- http://gallery-shop.site/42932448852huyzr.pdf
- http://alfa-quest.ru/the_classic_slave_narratives_henry_louis_gates_jrrrybl.pdf
- http://coloradocustomelectric.com/59165490801dnq15.pdf
- https://cdn.sqhk.co/lisutovudaf/ggPXhbS/blended_taro_bubble_tea_recipe.pdf
- https://static.s123-cdn-static.com/uploads/4481161/normal_600033da8e2b7.pdf
- http://strapslap.online/lagu_despacito_versi_angklung_malioboroq1fxc.pdf
- https://static.s123-cdn-static.com/uploads/4410217/normal_5ff1e43b75d8b.pdf
- http://opensol.xyz/what_does_it_mean_to_be_a_sensible_personwq12t.pdf
- https://static.s123-cdn-static.com/uploads/4384633/normal_6003278373a24.pdf
- http://agencymedia-ig.com/27167283bg3g6.pdf
- http://xsafak.com/legatezudumiluvodof1acn.pdf
- https://cdn-cms.f-static.net/uploads/4387711/normal_602f3be62922b.pdf
- https://cdn.sqhk.co/nilesatu/G9Ajiia/rum_balls_without_cocoa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/c3301231-5297-4633-abde-0547eb3cb250/2007_jeep_grand_cherokee_for_sale_craigslist.pdf
- https://uploads.strikinglycdn.com/files/bb983975-9218-4d36-af01-bc8b854fcfd9/chick_fil_a_menu_nutrition_salads.pdf
- https://uploads.strikinglycdn.com/files/6b44af43-30fd-4c03-91d0-3ec4ec989063/87915910734.pdf
- https://uploads.strikinglycdn.com/files/12008a18-2eeb-49c6-9fa4-a0458a09e9e6/what_is_the_goal_of_k_to_12_curriculum.pdf
- https://s3.amazonaws.com/mejifavo/buvozasoterugom.pdf
- https://s3.amazonaws.com/fizaxo/raxosevoxu.pdf
- https://uploads.strikinglycdn.com/files/371a5ff3-570e-4cf0-9a25-6fc016ebcd29/lego_mindstorms_card_shuffler.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e912.bind24814af0b1c48ea3a689057e4d9b3c38b66fa2dfa762c18b28b1abae0032a68 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE912 | 5356 bytes |
font_01_sfnt_off0000fb65.binc2f44ab07212b58bfa6c483fa014fce0c5732845b524b068c4ecaf9723317ea5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB65 | 10476 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.