MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to educational content, likely intended to trick the user into visiting the malicious URL for a phishing or malware download.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/wix?keyword=algebra+2+glencoe
- http://mubinazo.22web.org/aashiqui_2_movie_video_songs_free.pdf
- http://logowiwubapokar.iblogger.org/forklift_truck_daily_checklist_template.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://puwekaxaxowiza.epizy.com/carbohydrate_chemistry_and_biochemistry_structure_and_mechanism.pdf
- http://nozovov.rf.gd/a._m._u_application_form_2019.pdf
- https://uploads.strikinglycdn.com/files/09c89e5a-a758-484e-af1f-37bc55576c12/what_does_it_mean_when_the_link_light_is_blinking_on_my_modem.pdf
- http://xuvisoz.epizy.com/21750783339.pdf
- https://s3.amazonaws.com/nitajosasa/nabojebakegurav.pdf
- https://uploads.strikinglycdn.com/files/4b2f7eb1-0cc3-463d-b699-2a08d97a3688/jacobsen_mower_parts_dealer_near_me.pdf
- http://madojizekikozor.epizy.com/boxing_star_hack_apk_mega.pdf
- https://s3.amazonaws.com/kifutizijebuj/jeffrey_archer_books_mightier_than_the_sword.pdf
- http://bozonesowozo.epizy.com/nubupafetifeg.pdf
- http://vodadusilop.rf.gd/voucher_template_d365.pdf
- https://s3.amazonaws.com/pizivurapab/20974874097.pdf
- https://s3.amazonaws.com/jadere/13777245097.pdf
- http://pevivudawof.epizy.com/analog_and_digital_signal_processing.pdf
- http://zeliganav.epizy.com/39196009513.pdf
- https://s3.amazonaws.com/galinikagopit/actrapid_penfill_information.pdf
- http://wabamuvakotobu.epizy.com/bajilugeradevik.pdf
- https://uploads.strikinglycdn.com/files/481992a3-8ee1-4dc6-bd5e-3a366d8a6ffa/percy_jackson_lightning_thief_book_chapters.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dd5e.bin7f8be8ef1cd6d58c4b788ebc321ef3d7952a17367c624e3d2fde4fec6eda6c6a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD5E | 4708 bytes |
font_01_sfnt_off0000ed59.bin29aefe8164bca8736c3e50209a250863e70ad1122404a392dd59ec28daada62b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED59 | 10884 bytes |
font_02_sfnt_off000111dd.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111DD | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.