MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URI points to a suspicious domain, likely intended to host phishing content or a further payload. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, consistent with a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/strik?utm_term=rock+band+4+compatibility+list
- https://cdn-cms.f-static.net/uploads/4467003/normal_6032c66e26efc.pdf
- https://cdn-cms.f-static.net/uploads/4384639/normal_5fe902d9b3d1e.pdf
- https://cdn.sqhk.co/dofubetu/gh9hcjg/tornado_alley_states.pdf
- https://cdn-cms.f-static.net/uploads/4454811/normal_603844387c1d0.pdf
- https://cdn-cms.f-static.net/uploads/4488558/normal_6029977e52b7b.pdf
- https://cdn.sqhk.co/jexozumumanu/1idRKia/49856286479.pdf
- https://cdn-cms.f-static.net/uploads/4450517/normal_6041aacebf2a5.pdf
- https://static.s123-cdn-static.com/uploads/4445338/normal_5fe2afbc10f67.pdf
- https://cdn-cms.f-static.net/uploads/4393638/normal_5fd130602d559.pdf
- https://cdn.sqhk.co/xujurovemu/dViihfz/ligub.pdf
- https://cdn-cms.f-static.net/uploads/4463792/normal_601aff23cafe7.pdf
- https://cdn.sqhk.co/sebutarukaw/cp2Lqev/great_clips_near_me_open_now.pdf
- https://cdn.sqhk.co/jedelamodafa/gJtgfZm/lovonaju.pdf
- https://static.s123-cdn-static.com/uploads/4387716/normal_5ff16d79b3aa4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tabewozuzigenog.epizy.com/immanuel_kant_books_free_download.pdf
- https://uploads.strikinglycdn.com/files/ebb0d3d4-9d74-4e1a-8268-92821d30daec/adobe_audition_midi_keyboard.pdf
- https://uploads.strikinglycdn.com/files/e753a21c-771a-4e0c-ac7a-ae6d2e24bb76/second_order_derivative_exponential_function.pdf
- http://katewamopexo.rf.gd/tivumubiwevepafavatapax.pdf
- http://sikejafomanama.epizy.com/78260036689.pdf
- http://ziwufuv.rf.gd/97710239082.pdf
- http://vubolax.epizy.com/gexur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010471.bincabba6f6fb6b77cc7b65348da0cd3ec48bdb53d58318eba00e9fc27ada4a45f6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10471 | 5524 bytes |
font_01_sfnt_off0001173f.bin85ef8ea2b4a5ff82e6013e2e8433c6f1fac875b88778a4ff4e8df0a4b673c7ae |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1173F | 10928 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.