MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'zajinet.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains keywords related to concert tickets, suggesting a lure to entice users to click the malicious link. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing or downloader attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/wix?keyword=nba+youngboy+concert+tickets+2020+birmingham+alabama
- http://conicppjry.bid/pefojuzirajemyzp9n.pdf
- http://myshoes.moscow/nufokerewib50ti.pdf
- http://mimivamefigupe.sportsontheweb.net/the_art_of_power_jon_meacham.pdf
- http://xozowilozoga.mywebcommunity.org/what_are_the_main_traditions_of_christianity.pdf
- http://obzorov.site/87238272578zrs1n.pdf
- http://gatowixipeba.mywebcommunity.org/nujuvimelasolapojebi.pdf
- http://richteam.site/648614540919bgom.pdf
- http://xebubux.sportsontheweb.net/what_will_happen_to_your_eyes_if_you_cry_too_much.pdf
- http://fabulouss.space/xavevixoriwonuvejv5tp.pdf
- http://evilcheats.fun/zusizunofuridoxemalevivadwauuk.pdf
- http://cethq.xyz/how_to_fix_the_timing_on_a_bernina_sewing_machinemejq4.pdf
- http://100p-f.ru/mulanabixulelimafu2fhhk.pdf
- http://feyakast.online/ethical_hacking_meaning47aak.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_26ccba677bf6489d95ef6eb4c0e145ad.pdf?index=true
- https://s3.amazonaws.com/rovikibixu/vatican_museums_audioguide.pdf
- https://s3.amazonaws.com/zaxuledo/3095102252.pdf
- https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_c22ae6d552c444d4b98346a8a5005ce1.pdf?index=true
- https://s3.amazonaws.com/kikunojulejuj/the_emancipation_proclamation_worksheet_answers.pdf
- https://s3.amazonaws.com/bojafazes/11817684808.pdf
- https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_dc2ae0c9d24749aa9d4bb40ed3e7fc0b.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d32b.binda38126b1734b384371873f0d63a805d3868a331555b23f76b6dbabf2433b43f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD32B | 5760 bytes |
font_01_sfnt_off0000e6b4.bin82efef60cd918f9e8a8411664572140115b6151bb51ef2f3d084eb44cf238a44 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6B4 | 10152 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.