MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a lure related to resetting a garage door opener, which is a common tactic for phishing or malware distribution. It embeds a URL that likely leads to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/aws?utm_term=how+to+reset+liftmaster+garage+door+opener+keypad
- https://filukekab.weebly.com/uploads/1/3/4/4/134478490/zotasekamemazozowede.pdf
- http://1offpark.xyz/8283683651727hb8.pdf
- https://virefogagivagu.weebly.com/uploads/1/3/0/8/130815228/demanu.pdf
- https://jogexolo.weebly.com/uploads/1/3/5/9/135957561/nunidese-timazos-reradolobe.pdf
- http://prizinsta24.space/zuguz4j41q.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nuzabasere.rf.gd/fifoporalefobil.pdf
- https://s3.amazonaws.com/wipotegadodorek/66396345513.pdf
- https://uploads.strikinglycdn.com/files/cd76c82c-150a-4371-9275-bf082a8113a6/introduction_to_stata_course.pdf
- https://uploads.strikinglycdn.com/files/2d46bb5f-c415-4299-a26f-9432f7016006/57476600241.pdf
- https://ad0d0dbb-669b-46a9-85df-79487014a0f3.filesusr.com/ugd/00d95d_03df2ab9a14147cbb799723395fc22d4.pdf?index=true
- https://uploads.strikinglycdn.com/files/f26eef17-4275-449e-b437-777ca22434c4/dekilumavadapotezopowe.pdf
- https://s3.amazonaws.com/tutapaxi/36266375399.pdf
- https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_8a3fcbeebdab463890c7ab1e16ea8bcc.pdf?index=true
- https://uploads.strikinglycdn.com/files/e49ad1a8-d25f-444c-b90c-e09d0320e34e/simple_and_compound_probability_worksheet.pdf
- https://73099f28-10d5-4558-98a1-2f8dc61f1a2f.filesusr.com/ugd/f62eaa_6f18ae288cbb4c90bed7e0d62f81404b.pdf?index=true
- http://wexewowi.rf.gd/easy_soft_pastel_art_for_beginners.pdf
- https://uploads.strikinglycdn.com/files/41cdc6c0-6b14-4d19-b22d-7602e0fb126c/5x5_training_plan.pdf
- https://s3.amazonaws.com/tiniruru/9923392287.pdf
- http://dekidad.epizy.com/chemistry_experiment_report_sample.pdf
- https://8eccd3b7-fb20-4588-a5b5-4d8c58591879.filesusr.com/ugd/0e6328_b84a680596134d39a13223b8281e24fd.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dbe4.bin99e5feaa5bbf016685d5b8a427c06d4ffc3d409ac16038a8e441cd1edbecd62a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDBE4 | 5580 bytes |
font_01_sfnt_off0000eee2.bin3b594e99406bf29315775c00c09d58c5a3580446589d8d76d170d2a2f16e12ce |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEE2 | 10796 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.