MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains a URL leading to a malicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though truncated, suggests a lure related to a 'bug report'. The presence of embedded URLs and the ML classifier's high confidence indicate a phishing attempt designed to redirect users to a compromised site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/123?utm_term=cheritz+mystic+messenger+bug+report
- https://cdn-cms.f-static.net/uploads/4377400/normal_60412dc8b4c3f.pdf
- https://cdn-cms.f-static.net/uploads/4413587/normal_600c8b0a269f0.pdf
- https://static.s123-cdn-static.com/uploads/4386824/normal_5ff507edcaad6.pdf
- https://cdn.sqhk.co/nivunufozub/ZJ7hcic/figixawinevefonenalovet.pdf
- https://static.s123-cdn-static.com/uploads/4406481/normal_5ff10987c1eef.pdf
- http://vowufijetapiko.sportsontheweb.net/everything_explained_for_the_professional_pilot.pdf
- http://xunarepozufuz.mygamesonline.org/body_movement_worksheet.pdf
- http://zonokiwuwagupu.getenjoyment.net/mapa_biarritz.pdf
- https://cdn.sqhk.co/tivinarafuvu/aChhhbJ/ice_fire_wolf_wallpaper_download.pdf
- http://kefijor.mygamesonline.org/livavizijuwapewalugaruke.pdf
- https://kerawidirara.weebly.com/uploads/1/3/4/7/134746453/8690131.pdf
- https://wikafifej.weebly.com/uploads/1/3/2/8/132815388/be5a26cc1894a.pdf
- https://galixasuja.weebly.com/uploads/1/3/4/5/134518214/1115137.pdf
- https://static.s123-cdn-static.com/uploads/4451376/normal_5ffb50cdbaef4.pdf
- https://cdn-cms.f-static.net/uploads/4417325/normal_6009efbcf2a86.pdf
- http://ziwewixowele.sportsontheweb.net/junie_b_jones_read_aloud_book_14.pdf
- https://cdn-cms.f-static.net/uploads/4462345/normal_5fe9b96ceae92.pdf
- http://wedevaz.sportsontheweb.net/present_perfect_past_simple_lesson_plan.pdf
- http://zovolexune.sportsontheweb.net/how_to_adjust_ryobi_blower_carburetor.pdf
- https://cdn.sqhk.co/wibafozadil/hgfjfQI/business_name_generator_domain_checker.pdf
- http://fuvesozufinefi.medianewsonline.com/68988198273.pdf
- https://fomoxizukewoviw.weebly.com/uploads/1/3/0/7/130739072/f0b8766afeec7a7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c456.binb8db59fcc481f7689f40747a01cfba0d598d98b410437cf19245cf716b3b27f4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC456 | 5300 bytes |
font_01_sfnt_off0000d645.bin0073a60f25a6fce8798e2484670f3409a9e089bc14b6379cc69c71bce7a52327 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD645 | 10128 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.