MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains heuristics indicating an external URI and is flagged by a machine learning classifier and ClamAV as malicious. The embedded content, though heavily obfuscated, appears to be a lure related to furnace maintenance, directing the user to the malicious URL https://nipisod.ru/strik. This suggests a phishing attempt to redirect users to a potentially harmful site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=how+to+test+the+flame+sensor+on+a+furnace
- https://cdn.sqhk.co/suvezadamut/Jsjhgcu/volta_charging_headquarters.pdf
- http://pefiworawodud.mypressonline.com/words_that_start_with_koa.pdf
- http://sepoxudozixo.sportsontheweb.net/classical_guitar_hand_exercises.pdf
- http://falorilipeb.mywebcommunity.org/7399552202.pdf
- http://davupopebuwiser.sportsontheweb.net/how_long_have_jails_existed.pdf
- http://jekenufakewe.mypressonline.com/pafedonizozudatusovamoka.pdf
- http://befotuke.mywebcommunity.org/what_does_being_a_submissive_woman_mean.pdf
- http://nijalatol.mypressonline.com/thrustmaster_t-flight_hotas_x_flight_stick_ps4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/wixanarer/wetatoxemomegorupodob.pdf
- https://s3.amazonaws.com/vatosolikijike/bovine_viral_diarrhea_merck_veterinary_manual.pdf
- http://jabejanaboz.atwebpages.com/50675636152.pdf
- http://nukilaba.myartsonline.com/38438118553.pdf
- https://s3.amazonaws.com/gaxuremewuger/pesoboxupuzasojivujanu.pdf
- https://s3.amazonaws.com/limepusotanal/b._ed_exam_form_2019_mjpru.pdf
- http://tuwutexo.onlinewebshop.net/what_is_hardware_short_definition.pdf
- http://vorisenunajix.myartsonline.com/gubazuliba.pdf
- http://zevusup.atwebpages.com/87573959495.pdf
- https://s3.amazonaws.com/natewared/widagekim.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efad.binea438877f807973045dc5a810c2e3c17e4b370ed6f596572b4269bad7b52610a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFAD | 5008 bytes |
font_01_sfnt_off0001009c.bin2a38c47c5b580f1a79a544e142a53b5d70d9ccccf29bc18dd88409a9d274ceb0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1009C | 10540 bytes |
font_02_sfnt_off000124a1.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x124A1 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.