MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains a lure related to a yacht club waiting list. It embeds a URL that points to a malicious domain, likely intended to host a secondary payload or phishing content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=lewes+yacht+club+waiting+list
- http://drovazvenigorod.ru/79534010220b25jh.pdf
- http://probmaka.tech/tajodujalutujeyy86b.pdf
- https://static.s123-cdn-static.com/uploads/4456985/normal_5ffa029b4680c.pdf
- https://cdn.sqhk.co/lebudawojafi/Hc8dggN/class_valuation_appraisal_phone_number.pdf
- https://cdn-cms.f-static.net/uploads/4501656/normal_600c7e882b404.pdf
- https://cdn.sqhk.co/woselukafo/hgQhbNK/66756142565.pdf
- http://hd-cam-mirror-up1.club/cat_rescue_near_me_no_killj6fy6.pdf
- https://cdn.sqhk.co/metexemoraga/Jygehdq/mod_mapa_portugal_euro_truck_simulator_2_indonesia.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/purufiz/romuzulilu.pdf
- https://a19d597f-2220-41b3-9459-688249e8a20b.filesusr.com/ugd/f19f53_ba2701f74a33466597ab72be8f717610.pdf?index=true
- https://s3.amazonaws.com/jejulurowev/quartz_minerals.pdf
- https://22fea36a-5e19-4af1-b4aa-fe6e1efe0ee9.filesusr.com/ugd/b5a188_99b911bbd9634f7a916a2a225c33d1a2.pdf?index=true
- https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_9f96875f77564e0091498cf09441c638.pdf?index=true
- https://f3874c2d-c116-49c2-b7b6-9300dc8fc43e.filesusr.com/ugd/b11f6d_551d7ac00f8341e29a2ec95014a270c2.pdf?index=true
- https://f1e11ea9-a931-46ad-af30-391325c877dd.filesusr.com/ugd/423518_a160e0d0a9cd44ec83af20adc122fca5.pdf?index=true
- https://s3.amazonaws.com/pukaridimupo/bijesomitusejakireji.pdf
- https://s3.amazonaws.com/jidosatikim/only_incidental_services_reported_on_this_claim.pdf
- https://s3.amazonaws.com/belopudevuzuza/what_is_the_difference_between_system_development_life_cycle_and_software_development_life_cycle.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec66.binbc6e29b40e0cb52ca49cd74c5632173453827d1f5d3fee62892a9a25eb4320db |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC66 | 5240 bytes |
font_01_sfnt_off0000fe5b.binb7c835030ad9e48a9c90e9dc3e4e98ce2e002915b51e5763f6a3d204f5024ef2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE5B | 11188 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.