MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF document was flagged by a machine learning classifier as malicious and also detected by ClamAV as a phishing trojan. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' indicates the document instructs users to copy and paste content into a shell, a common technique for executing malicious commands. The embedded URLs, such as 'https://soxebez.ru/123?utm_term=crack+office+professional+plus+2016', suggest a lure related to software cracking, which is often used in phishing campaigns to deliver malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/123?utm_term=crack+office+professional+plus+2016 PDF link annotation
- https://cdn.sqhk.co/jumifokujuje/8I5vjdP/bowixiradefovawizowetam.pdfIn PDF document text
- http://wozonos.22web.org/82054547424.pdfIn PDF document text
- https://bifukumuvu.weebly.com/uploads/1/3/5/3/135347201/5379548.pdfIn PDF document text
- https://cdn.sqhk.co/satukevaguka/anjjjja/electric_circuit_tester_buy.pdfIn PDF document text
- https://cdn.sqhk.co/kuwusemob/D8ifij3/27208998277.pdfIn PDF document text
- http://oneitshop.pro/dave_ramsey_financial_peace_university_courseqoyzh.pdfIn PDF document text
- https://banabujoro.weebly.com/uploads/1/3/0/7/130776007/gibemakaseni.pdfIn PDF document text
- http://rollernefritmassage.xyz/migifijtvsfm.pdfIn PDF document text
- https://zikawudewodag.weebly.com/uploads/1/3/4/5/134585044/tofux_samog.pdfIn PDF document text
- http://idealica-italiaufficiale.site/resumo_historia_do_brasil_enemtm1qm.pdfIn PDF document text
- https://cdn.sqhk.co/zavilisuga/xjj5Fig/lesson_plan_ideas_for_infants.pdfIn PDF document text
- http://mx50off.pro/how_to_program_baofeng_uv-82ca9b86.pdfIn PDF document text
- https://retinagarar.weebly.com/uploads/1/3/4/3/134319249/1a3a0b.pdfIn PDF document text
- https://kezofufilulo.weebly.com/uploads/1/3/4/4/134488682/taguzevixosadedi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4c7680d0-75ae-4a09-a1c2-c231a653c628/remote_software_testing_jobs_near_me.pdfIn PDF document text
- https://s3.amazonaws.com/lomogas/example_of_freuds_theory_of_personality_development.pdfIn PDF document text
- http://vifotuniso.rf.gd/how_much_do_house_trusses_cost.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86fb3ce3-a051-434a-9e6d-3bd71c21ffd1/68992586274.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a954b2f-874a-4aed-ace7-1e111888fa66/tamukotugagafibelutivar.pdfIn PDF document text
- https://s3.amazonaws.com/jivagajamav/after_effects_free_transform_layer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/783fb944-090e-4070-b8cf-90d1840b8b93/kevogokejali.pdfIn PDF document text
- https://s3.amazonaws.com/wazagidonux/home_hvac_design_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f7b1655a-e0cf-43d6-8522-a34e389bd544/craftsman_10_sliding_compound_miter_saw_review.pdfIn PDF document text
- http://tajomum.epizy.com/identifying_theme_worksheets_5th_grade.pdfIn PDF document text
- http://koratiluvukeji.epizy.com/38166464251.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f819.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF819 | 5456 bytes |
SHA-256: 6ff59e6901e8f3a63c2b95bfbfd70c77f8bd12abed665e5be7685249a3e6ec19 |
|||
font_01_sfnt_off00010abd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ABD | 10952 bytes |
SHA-256: 8f6232766ad9c0a0be916917352dee2d560f32c206d54a6315601364929e1588 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.