MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. The embedded URL and document metadata suggest a lure to download a file, likely a malicious payload, disguised as a job application. No scripts were extracted, but the PDF structure and external URL indicate a phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=download+contoh+surat+lamaran+kerja+dan+cv+pdf
- https://cdn.sqhk.co/xoraxuvonaf/6hhihJf/60201188664.pdf
- https://cdn.sqhk.co/fepogosu/cjkgeST/3d_stack_3d_block_puzzle.pdf
- https://cdn-cms.f-static.net/uploads/4404725/normal_60608324199d8.pdf
- https://cdn-cms.f-static.net/uploads/4387226/normal_604cdd4e8ad9e.pdf
- https://cdn.sqhk.co/gusiloxi/ahiSPii/super_pinball_master.pdf
- https://cdn.sqhk.co/wetabupi/Wja4ggj/75334139194.pdf
- http://bojukekaj.66ghz.com/kivorujedamadixufukekafaf.pdf
- https://cdn.sqhk.co/patagarinixa/uhjhfoK/ninja_smoothie_blender_blade.pdf
- https://static.s123-cdn-static.com/uploads/4408596/normal_5fe25c1c49fb0.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a59fc9ee-647b-437a-9410-311dac90943b/lokowulunasedi.pdf
- http://kolowesusudidib.rf.gd/41327996023.pdf
- https://uploads.strikinglycdn.com/files/a14c28c2-4337-4361-a178-71b53bf6b0ac/4_pics_1_word_level_2207_answer.pdf
- https://uploads.strikinglycdn.com/files/040e6faa-b2f8-475c-a360-85a456f5af2b/98445164825.pdf
- https://uploads.strikinglycdn.com/files/1175d3dd-f54b-4f68-acca-a19ed454a93f/arkansas_drivers_permit_restriction_codes.pdf
- https://uploads.strikinglycdn.com/files/924859d3-6b05-4d87-9f46-0b6a52ba398f/ohms_law_problems_with_answers.pdf
- https://uploads.strikinglycdn.com/files/ae5b26bb-e46e-4d5e-8fd1-63bbaf063a0d/59003071914.pdf
- http://rovikejovejoto.rf.gd/fapojakuba.pdf
- http://wafijolosa.epizy.com/can_you_import_audio_files_into_garageband_for_ipad.pdf
- https://uploads.strikinglycdn.com/files/5f11eb2d-b2f7-4a8d-a077-0026e92f64db/dazefubovozomirezozifila.pdf
- https://uploads.strikinglycdn.com/files/48ebf65e-3f67-4aab-8a36-725fb9d08ba1/25211183720.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f8d0.binf58f858be6a956750be5e60d4e1be3f039b5d001fff92cb62423799ecff94eec |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF8D0 | 5688 bytes |
font_01_sfnt_off00010c1d.binc316114adff7a08fb10bb34cb561442eb0d1c4e6695053b3e476c12cc1610143 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C1D | 10672 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.