MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF containing an embedded URL that leads to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, appears to contain keywords related to product listings, suggesting a phishing or scam lure. No scripts were extracted, but the presence of external URIs strongly indicates an attempt to redirect the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/123?utm_term=808+keychain+camera+battery+replacement
- https://cdn.sqhk.co/dafisuwikib/h1hizgg/68482629161.pdf
- https://cdn.sqhk.co/ligumorik/iCjcGih/thoracic_cavity_function.pdf
- http://tetupamino.mywebcommunity.org/repodu.pdf
- https://cdn.sqhk.co/kitujesijak/h80gJaL/sad_video_status_share_chat_kannada.pdf
- http://dirujadejefogax.iblogger.org/open_source_business_card_scanner_android.pdf
- https://cdn.sqhk.co/banuluwopote/cwaheHQ/20356270418.pdf
- https://cdn.sqhk.co/tabuguran/igXkifl/farming_tractor_drive_simulator_tractor_game.pdf
- http://kilijosizujowo.medianewsonline.com/suzukojadiva.pdf
- https://cdn.sqhk.co/barevirus/aggvdij/32710195369.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://0e8f88b9-656e-4b05-9cd8-8bd477f85547.filesusr.com/ugd/95b9ea_dd14ccff938e4484af7347cc440f8eac.pdf?index=true
- https://s3.amazonaws.com/wexukufedepim/bang_bang_full_movie_free_480p.pdf
- https://s3.amazonaws.com/rufonali/apis_florea_information.pdf
- http://suzufazelebumu.rf.gd/zuxevoxupi.pdf
- https://77a80da1-97a3-4b40-ba11-54c6d232eb66.filesusr.com/ugd/39a0fd_efda9dc362fd48659486c94dfb73fcba.pdf?index=true
- https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_83856b2f24f44286a998f8bb25443550.pdf?index=true
- https://s3.amazonaws.com/vinejivunitego/suxilipodomuriledoxega.pdf
- https://87c8fc71-818b-4167-bf0d-2ac3bc49ffd1.filesusr.com/ugd/f9d4cd_981c6b1eaa06433892ae5d42c532d42a.pdf?index=true
- https://s3.amazonaws.com/domegagowevag/autocad_lt_2014_32_bit.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dfe0.bin2ae83d099b220fa91a5ea18d94f5703c04dc39f2bc555ac1f142fb2de9c6a1c4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFE0 | 5540 bytes |
font_01_sfnt_off0000f290.bin98765961ffc4e4f22199f757db9881505c76dda52a95391b321f846cdd06b223 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF290 | 11152 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.