MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is a PDF that has been flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and phishing-related. It contains an embedded URI pointing to 'botokaw.ru', which is likely a malicious download or phishing site. The presence of a 'download button' heuristic further supports the phishing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9963
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=borislav+pekic+besnilo+pdf+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4368504/normal_605bee0521057.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366339/normal_600d79ad9ef9b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4497687/normal_5ff2c6334f874.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4467945/normal_600d3d4351c1f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460446/normal_5feecb915522c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421339/normal_5ff24853183ad.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366302/normal_60509947e70de.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4443598/normal_6006607125184.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448549/normal_603855f1277e4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4499283/normal_6021d319daf52.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420020/normal_6063a1795df2d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4496146/normal_60542f03cef07.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368505/normal_606ea78aca66b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412158/normal_604cc6080467b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371272/normal_5fed32bd9a669.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409606/normal_604038df0c315.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://uploads.strikinglycdn.com/files/ae71ba2c-4f00-47e2-81f7-e16dc820cdca/89153614100.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a617db77-6e41-4230-b3d1-56393561d0cb/50684221921.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/187a5808-f765-48f9-bde4-36b1b39c5037/l3110_epson_ink_adjustment_program_software_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/079a1708-530f-4488-82eb-3be85dc3388a/rapobenakusiwu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd28ffca-4bce-41f7-8180-b206dcff04ff/97424046894.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5c6c75bc-773d-4112-8415-d5b80fa61499/beats_by_dr_dre_solo_3_wireless_bluetooth_headphones_-_white.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6893437-2be5-4acf-8ca7-9c5b916696bc/22981647562.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011e9c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E9C | 11028 bytes |
SHA-256: 8d85d476263fd4c97e3769025362b6e3c941b75d99771623e466b1dae8ac7dfa |
|||
font_01_sfnt_off00014351.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14351 | 5556 bytes |
SHA-256: 68d818a46752ec5e3a2e99bd6279fa811ec0650b214f7ba0e0ae3e2d332346ff |
|||
font_02_sfnt_off0001564a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1564A | 6304 bytes |
SHA-256: 93c98beeae73c680e31fc082f9692e6428d285cfc1e100a6ccaff544859ca368 |
|||
font_03_sfnt_off000166c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x166C2 | 17372 bytes |
SHA-256: 419e355c8533ff439a882b0f1ccacf1eb5f6b94d45ff080db51d5634fec62cc1 |
|||
font_04_sfnt_off00019b6b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19B6B | 16884 bytes |
SHA-256: 1814a72421bd0cb70f3f0500683689f0ad3f3e8d85b41f0b8d64fc8e1c7474d0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.