MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as a malicious PDF by multiple heuristics and a machine learning classifier. It contains an embedded URI pointing to a suspicious domain, and the heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive. This suggests a multi-stage attack where the PDF serves as a lure to download further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/wb?keyword=escribe%20una%20definicion%20propia%20de%20aprendizaje%20basado%20en%20proyectos
- http://pornbustyvids.com/planetary_gear_calculatoriukcs.pdf
- https://cdn-cms.f-static.net/uploads/4373509/normal_5fd787b98a1a1.pdf
- https://static.s123-cdn-static.com/uploads/4387826/normal_6005f32296120.pdf
- https://static.s123-cdn-static.com/uploads/4412159/normal_5ff4fb9d7e3b2.pdf
- http://ductsunlimitedins.com/23795217075p2nrr.pdf
- https://static.s123-cdn-static.com/uploads/4393893/normal_5fca6ad984e4d.pdf
- http://momsmall.space/african_languages_an_introductionlw8ca.pdf
- http://ziponep.22web.org/microevolution_and_macroevolution_worksheet_answers.pdf
- https://cdn-cms.f-static.net/uploads/4389582/normal_603821203363a.pdf
- http://sokadap.22web.org/81999444591.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://sosozodazu.epizy.com/chuck_e_cheese_report_card_coupons.pdf
- http://mitudosukekunif.epizy.com/kadar_caruman_sip_2018.pdf
- https://s3.amazonaws.com/forupokisip/sibubevewot.pdf
- http://vutaxinasiva.epizy.com/xufirawobexegorugojeg.pdf
- http://zapulozamatuwe.epizy.com/68381884904.pdf
- http://fakexebubigej.rf.gd/consumer_reports_washer_dryer_combo.pdf
- http://wadoromutisagar.myartsonline.com/49910032617.pdf
- http://wutesejib.onlinewebshop.net/how_to_clean_a_riding_lawn_mower_carburetor_without_removing_it.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010653.binf453251484837988a0456fe11e8097b37737c1d20283404e8346d06cb4fa89fa |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10653 | 5440 bytes |
font_01_sfnt_off000118fc.bin08bffe3f475109941c97c116a1e9b7a1f76b2d4140c7cfe6447f7a07fbf84730 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x118FC | 12056 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.