MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, and exhibits characteristics of an advance-fee scam. The embedded URL 'https://mezovuduw.ru/wix?keyword=bakewise+pdf+download' suggests a lure to download further malicious content. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate it is designed to deceive the user into a fraudulent transaction or to download a secondary payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9973
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/wix?keyword=bakewise+pdf+download
- http://easterthjg.com/informacion_de_ballenas_jorobadas_en_inglesxpfbw.pdf
- https://cdn.sqhk.co/xuxozowaki/shgy7Jy/crunchyroll_free_premium_trial.pdf
- https://cdn.sqhk.co/virurewev/DXZ4ojb/zomixibomujusu.pdf
- https://cdn-cms.f-static.net/uploads/4372737/normal_600fd54117b36.pdf
- https://static.s123-cdn-static.com/uploads/4458824/normal_5fee0fc609d67.pdf
- https://static.s123-cdn-static.com/uploads/4365624/normal_5ffe08652cb2c.pdf
- https://cdn.sqhk.co/niserutom/ChfChaq/30509493834.pdf
- http://instapriz365.online/director_report_of_reliance_2017crhid.pdf
- https://vexefanakaxaki.weebly.com/uploads/1/3/4/8/134871487/d9851.pdf
- https://gegotebure.weebly.com/uploads/1/3/1/6/131606057/0e468c5b05.pdf
- https://bejolikide.weebly.com/uploads/1/3/1/4/131437094/8377662.pdf
- https://static.s123-cdn-static.com/uploads/4368222/normal_6006ecb2d5ab0.pdf
- https://cdn-cms.f-static.net/uploads/4367617/normal_603a9d139debc.pdf
- https://cdn-cms.f-static.net/uploads/4376369/normal_600b3b72a8b61.pdf
- https://niraxonaweza.weebly.com/uploads/1/3/4/0/134000156/4502891.pdf
- https://cdn-cms.f-static.net/uploads/4464521/normal_60377833dd01a.pdf
- https://fuviwezajoz.weebly.com/uploads/1/3/1/3/131379384/4821838.pdf
- https://static.s123-cdn-static.com/uploads/4409123/normal_5fe0296333610.pdf
- https://static.s123-cdn-static.com/uploads/4486061/normal_5fcf2f5b2b436.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/nevowimo/free_lagu_chrisye_pergilah_kasih.pdf
- https://s3.amazonaws.com/dusubonifu/sample_resume_for_experienced_business_analyst.pdf
- https://s3.amazonaws.com/wovugi/runedelig.pdf
- https://s3.amazonaws.com/topipovikapari/10482932566.pdf
- https://s3.amazonaws.com/migivewuwe/maze_runner_books_ranked.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00014fc5.binb7bca47c189e894b7949ff82559cf70ead718dc70f7726010802625b3b07d882 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14FC5 | 4852 bytes |
font_01_sfnt_off00016064.bina60956c12de9d55db76aa4f4dfc9c7f7f7a5c4220db2110615c40cfc0629d1c6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16064 | 12560 bytes |
font_02_sfnt_off000188ea.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x188EA | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.