MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that directs users to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to be a lure related to 'Hizbul bahr audio' to mask the malicious intent of redirecting to the external URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/strik?utm_term=hizbul+bahr+audio
- https://cdn-cms.f-static.net/uploads/4424997/normal_5f9e80b26e4f3.pdf
- https://cdn-cms.f-static.net/uploads/4390051/normal_5fd6d481281ca.pdf
- https://cdn-cms.f-static.net/uploads/4410432/normal_5fd315437253e.pdf
- https://cdn-cms.f-static.net/uploads/4367668/normal_5fb96fd4e6375.pdf
- https://cdn-cms.f-static.net/uploads/4374698/normal_5fd15b4cc8e9e.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static1.squarespace.com/static/5fce777cfb1cfe1f8fb48c4f/t/5fd163d999fe644e8a52944f/1607558106391/fox_mountain_bike_gloves_australia.pdf
- https://uploads.strikinglycdn.com/files/a0936f1a-43bc-40d6-a317-798e73e69f94/tituwonezobuviz.pdf
- https://static1.squarespace.com/static/5fc5bdc540f1034a5cca01ae/t/5fca95d2453475472aad36fa/1607112147196/police_siren_sound_download_free.pdf
- https://static1.squarespace.com/static/5fc3703b8ef7301f8b20f9e5/t/5fd08d43a040431536c1220f/1607503172178/80202280777.pdf
- https://static1.squarespace.com/static/5fc1651bc89e1c4b8fc1e357/t/5fc2f8943f75b1664336822c/1606613140785/notary_signing_agent_jobs_near_me.pdf
- https://static1.squarespace.com/static/5fc6cf121a9b7f6479338f83/t/5fce9b299b95ec1b512b973d/1607375657979/dabud.pdf
- https://static1.squarespace.com/static/5fc566ac3dfdd95b60f3409b/t/5fd65ebf313c42342b8c9c96/1607884484499/herewith_attached_the_report.pdf
- https://uploads.strikinglycdn.com/files/1b025245-4180-4b65-b5e4-f857f373c184/lost_ways_book_amazon.pdf
- https://static1.squarespace.com/static/5fc53140085bf90c0e192ce8/t/5fc904e7a7528e11dbb67d3b/1607009512070/34547203322.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ae75.bin7a8063b166bb0ffa00d734a0e47068bb7297398e8c5ad8dec37d18176e1bd902 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAE75 | 4884 bytes |
font_01_sfnt_off0000bf05.bin71e2c322327638f13d0858090b2b12f2cf0cb23f92858d57617245a8391ff12c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBF05 | 10448 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.