MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, suggesting it's used to redirect users to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=cuisinart+dgb-800+burr+grind+%2526+brew+12-cup+coffeemaker
- http://about-central.com/dazevalezonotq1hqo.pdf
- https://cdn.sqhk.co/pumevigatare/chiu4NL/crowd_sounds_nfl_2020.pdf
- https://cdn.sqhk.co/jujuziwe/ajb7Xjb/glitch_effect_photoshop_gif.pdf
- http://zoguponuwuxoli.medianewsonline.com/35243536577.pdf
- https://cdn.sqhk.co/patemugimej/Xhjchjn/twisted_wonderland_leona_gallery.pdf
- https://cdn.sqhk.co/libodinidep/jaIhdhd/britney_spears_american_dream_hack_download.pdf
- http://foodguideblog.com/wuporejuxotiruwefefefglzwb.pdf
- http://blognews.top/pan_card_offline_form_49a54yyb.pdf
- http://natbeach.space/vewimiwinaiws9c.pdf
- https://cdn.sqhk.co/vakujediraw/Igd2heZ/gazexelafolam.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/488e168b-f51f-4c1c-b6f6-2443337daad5/womavivuvexumarazonuli.pdf
- https://uploads.strikinglycdn.com/files/e49404fc-6dad-48e7-ab73-bad2c10ad1e5/97910247123.pdf
- http://sadabodavezuzi.epizy.com/finger_math_worksheets.pdf
- http://likamufibunefar.epizy.com/ragal.pdf
- https://uploads.strikinglycdn.com/files/46461fd7-1a6b-4977-bc34-5c66ad4c5b42/tilanajune.pdf
- http://kedisijusa.onlinewebshop.net/87297051200.pdf
- https://uploads.strikinglycdn.com/files/5ef6fc23-1c1c-4473-9321-b02646334cc3/what_were_three_goals_of_the_radical_republicans_during_reconstruction.pdf
- http://laxuzoto.onlinewebshop.net/101_algebra_problems.pdf
- https://uploads.strikinglycdn.com/files/aa324a29-c9b9-4bdb-bd1f-f772e46c81f8/74000825655.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee48.binddcd8901bbc7110683e8fecab69d5cfa18b67c51a409baf7d3d4d1f6404dd9ec |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE48 | 5376 bytes |
font_01_sfnt_off00010094.binad490377aa829d9aa97c95d885a0357beb51c305fa3bea5951b1ec34530ba855 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10094 | 10520 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.