MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting the document is a lure for phishing or malware delivery. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of common phishing techniques.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/wix?keyword=the+princess+bride+study+guide+questions+and+answers
- https://cdn.sqhk.co/nosimasiv/iiOjhif/61221282170.pdf
- http://tirevuvezig.22web.org/seasonal_round_archaeology_definition.pdf
- http://sevazumemozoli.22web.org/73257336601.pdf
- https://jitebemaduk.weebly.com/uploads/1/3/4/6/134692965/4745b23d5c72c.pdf
- http://ig-copyrightnotice.com/basic_elements_of_design_value_examples31nty.pdf
- https://gefobivuvevu.weebly.com/uploads/1/3/1/3/131380717/5bbf432f82b.pdf
- http://repair-planshetov.ru/830970050174502q.pdf
- https://cdn.sqhk.co/zekuxemelop/pIgchaw/my_talking_tom_mod_apk_download_free.pdf
- https://jarupaxalimex.weebly.com/uploads/1/3/5/3/135324443/vafemutuvekuxufinuv.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bibikefogive.epizy.com/84407941445.pdf
- https://e809654a-a95b-4dbc-a338-24085255a2f8.filesusr.com/ugd/1b6cec_a7b8f446bb8349a78142b4d34199f389.pdf?index=true
- https://3f5765b5-411c-4b28-96d1-a1e3b219bcee.filesusr.com/ugd/ca847e_d0757487b98343b788be0602fee4c119.pdf?index=true
- http://lumaxixi.epizy.com/beats_by_dr._dre_solo3_wireless_on-ear_headphones_review.pdf
- http://fubolorira.epizy.com/math_riddle_answers_search.pdf
- https://3437305d-a3f4-4f94-9a63-846dd410f5be.filesusr.com/ugd/ffe76b_1b1a8b9dcfdc4513a43b65ae46e73c4a.pdf?index=true
- http://ninanupazazudad.rf.gd/princess_diaries_2_full_movie_with_english_subtitles_watch_online.pdf
- http://bufiziwo.rf.gd/34536935085.pdf
- http://revuzinolijafit.epizy.com/the_body_language_of_love_free_download.pdf
- http://povokufav.epizy.com/what_size_file_for_.325_stihl_chain.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec50.binba64adc68cadce29085626e5b5b1430cdb131647994b19edbc502ca7ecb48894 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC50 | 5712 bytes |
font_01_sfnt_off0000ffba.bina5e3b54049c799f19ee51a4fc361f054e91eb16fd33a37dd3dd95d0b4828700b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFBA | 10744 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.