MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://allytemp.ru/pbw?utm_term=wow+tv+guide+columbus+ohio', which is likely a phishing lure or a distribution point for further malicious content. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a TV guide. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allytemp.ru/pbw?utm_term=wow+tv+guide+columbus+ohio
- https://cdn-cms.f-static.net/uploads/4476126/normal_603e817ceb6b1.pdf
- https://cdn-cms.f-static.net/uploads/4370269/normal_6044a54753cf8.pdf
- https://static.s123-cdn-static.com/uploads/4463286/normal_5fff5906c598d.pdf
- https://static.s123-cdn-static.com/uploads/4418579/normal_5febaafe17636.pdf
- https://cdn-cms.f-static.net/uploads/4495040/normal_601f994333c08.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d3cef060-044d-47c0-8d6d-b17891c22f32/39635572801.pdf
- https://uploads.strikinglycdn.com/files/80d547bc-d5cb-4dee-b6ec-3b4761ec49cf/6716933172.pdf
- https://uploads.strikinglycdn.com/files/6819cce5-2ba7-454e-81c2-12b3716c645a/bifofafimofiwotulori.pdf
- https://uploads.strikinglycdn.com/files/1f8e2b00-a4f1-4d31-9304-0ea7df291abf/libro_los_7_habitos_de_la_gente_altamente_efectiva_descargar_gratis.pdf
- http://zopujoxobug.pbworks.com/w/file/fetch/144413553/how_to_prepare_income_and_expenditure_account_and_balance_sheet.pdf
- https://uploads.strikinglycdn.com/files/4f00ea11-8584-4dc8-a66f-4ee42add28a7/sony_32_inch_led_hd_ready_tv_klv-32w622e.pdf
- https://uploads.strikinglycdn.com/files/2808d98f-69f5-47d6-a65f-c766bb6f6f3d/tanujekenumatu.pdf
- http://vawaguzidatu.pbworks.com/w/file/fetch/144424038/crew_member_job_description_for_resume.pdf
- https://uploads.strikinglycdn.com/files/d6111ed2-574e-4d70-bae5-6c4946b0a153/what_is_an_artist_statement_and_bio.pdf
- https://uploads.strikinglycdn.com/files/0d56158b-7075-416f-be54-89dd681abbc7/kedawefumaduw.pdf
- http://poxanoralanu.pbworks.com/w/file/fetch/144426225/dakifufabalanutudu.pdf
- https://uploads.strikinglycdn.com/files/9d3643bb-48d3-4108-82e8-804d745d6933/watch_wuthering_heights_movie_online_free.pdf
- https://uploads.strikinglycdn.com/files/523a58b8-846a-4fad-9d77-a7b3a594e8b3/to_all_the_boys_i_loved_before_cast_2.pdf
- https://uploads.strikinglycdn.com/files/76b48d60-9581-4404-b324-1c1ce28e4fee/pogibonotimotaxa.pdf
- https://uploads.strikinglycdn.com/files/3a2c6cee-2163-44e3-805d-432eab6c09c3/yamaha_rx-v673_price.pdf
- https://uploads.strikinglycdn.com/files/7e01058e-9542-4748-b653-a72ecf73f696/the_killing_joke_hardcover.pdf
- http://kiletejude.pbworks.com/w/file/fetch/144412422/how_to_fake_a_doctors_note_for_school.pdf
- https://uploads.strikinglycdn.com/files/8aff68d6-81f7-4b55-8c18-f248563dd4fc/33689875247.pdf
- https://uploads.strikinglycdn.com/files/002da7f2-962b-4279-9181-49236521627b/wipisipur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eaa8.bin1f90d085cd6a21a7d8437a2be50b03b4c4c1804f8ba885825cda58046f0a26c1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAA8 | 5352 bytes |
font_01_sfnt_off0000fcdb.binab8925d3b27238703b4fd6c47e77d67108a2abfe8f3123b91587faeed186522c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCDB | 10944 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.