MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a link disguised as a movie download, which leads to a malicious domain. ClamAV and ML classifiers identified this file as malicious, specifically a phishing trojan. The embedded URL is the primary indicator of this phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/wix?keyword=toy+story+4+full+movie+free+download
- https://cdn-cms.f-static.net/uploads/4369164/normal_603626c609897.pdf
- https://static.s123-cdn-static.com/uploads/4419204/normal_5fecbf49389c8.pdf
- https://cdn.sqhk.co/jimevexir/jfjhgdG/ddpai_mini_3.pdf
- https://cdn-cms.f-static.net/uploads/4452618/normal_605d65af10fc3.pdf
- https://static.s123-cdn-static.com/uploads/4413977/normal_5fe6011f5bd6b.pdf
- https://cdn-cms.f-static.net/uploads/4391915/normal_601d5b7937f0f.pdf
- https://cdn.sqhk.co/bepigulusibe/3Yqxbje/19922012978.pdf
- https://cdn-cms.f-static.net/uploads/4474734/normal_60235ee816ec4.pdf
- http://mawidoxejonej.iblogger.org/wings_of_fire_bengali_version_download.pdf
- http://fogarapisow.22web.org/the_magus_fowles_movie.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://f9cb7010-568c-45d0-b0a5-7bd630b60272.filesusr.com/ugd/b10ea2_46586450b71e4622977f676c5139da9d.pdf?index=true
- https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_4ebb1c9dc06044f29475ee4a44b4411f.pdf?index=true
- https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_4f2899069a63464cb04cc69a2ce35f16.pdf?index=true
- https://s3.amazonaws.com/gisujubolidine/bukota.pdf
- https://s3.amazonaws.com/juduk/xisipaguzarabu.pdf
- http://vutuzirowu.rf.gd/fema_is_405_test_answers.pdf
- https://s3.amazonaws.com/geraromu/cue_sheet_multiple_flac_files.pdf
- https://s3.amazonaws.com/ximupuv/gebuzatudurokedemukemazu.pdf
- https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_e32a96e398cf4e6f8c2c928cbe49a691.pdf?index=true
- https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_abf3b5eec03b4eea9598cf78b4fde264.pdf?index=true
- http://jazupizewatabal.epizy.com/calgary_zoo_map.pdf
- http://jexukavelewin.rf.gd/binding_of_isaac_rebirth_all_transformations.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee40.bin71a18d1e05bcb6e5397a9b0673f45a7ab7454269ca05c26cecf3143c1c82b6f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE40 | 5344 bytes |
font_01_sfnt_off00010074.bin8a5d2455003228d3ec6d583fd924c24f33f990c7172ef4c208730a6d5c90cb90 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10074 | 11424 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.