MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL pointing to 'dafemum.ru', which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, appears to reference 'Burger King breakfast menu', suggesting a lure to trick users into visiting the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=burger+king+breakfast+menu+low+calorie
- https://cdn.sqhk.co/posojuvapono/gjFibje/winrar_64_bit_windows_10_download_free.pdf
- https://cdn.sqhk.co/joxipadij/iSibYwj/hmrc_grant_claim.pdf
- http://lesorurudefige.iblogger.org/adneksa_kulit.pdf
- https://cdn.sqhk.co/bivuwusim/jggjr2Z/traffic_rider_game_hack_version_apk.pdf
- https://cdn.sqhk.co/tevotapomow/ggjg76f/time_craft_epic_wars._com.pdf
- https://cdn.sqhk.co/kutajanode/jkAFkgc/buzitutor.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f1473421-a087-42aa-86fe-5b120a0ed95a/63873436398.pdf
- https://s3.amazonaws.com/zusevamasor/97782858808.pdf
- https://uploads.strikinglycdn.com/files/cbecfc62-2433-47b9-9f06-1c036a26b57e/duzuminifote.pdf
- https://s3.amazonaws.com/mudurixo/3571818462.pdf
- https://s3.amazonaws.com/senodiw/surilasipaviw.pdf
- https://uploads.strikinglycdn.com/files/03fe725e-f965-4e12-b529-5749850af580/where_is_the_boomerang_in_links_awakening_switch.pdf
- https://s3.amazonaws.com/bejenosugede/lidomexojus.pdf
- https://s3.amazonaws.com/roxawo/62681578476.pdf
- https://s3.amazonaws.com/jiwisi/tuvabirinet.pdf
- https://uploads.strikinglycdn.com/files/65609e1e-a092-454a-96aa-9fa0fd9ef274/gofuwini.pdf
- https://uploads.strikinglycdn.com/files/d81b0439-8ed6-442a-a895-5eb6e78970a4/vilupa.pdf
- https://s3.amazonaws.com/dezajok/82298988917.pdf
- http://bexipazo.rf.gd/armenia_earthquake_reconnaissance_report.pdf
- https://uploads.strikinglycdn.com/files/a05c730b-c9de-4e1d-a1a4-158de2b2e359/how_to_get_a_job_at_the_us_post_office.pdf
- https://s3.amazonaws.com/viwoxuz/adaway_android_pro_apk.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea1a.bina98cc918201610dd8b220aac9f4e3391307f491395910326f4f372b0db593265 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA1A | 5544 bytes |
font_01_sfnt_off0000fd04.bin6b5310d04a2085c6bd907d4c09252eae6f06fb7be72375b3bda2525db322272b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD04 | 10936 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.