MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a domain that appears to be distributing malware, disguised as a download for 'Team Fortress 2 hat generator v5'. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may instruct the user to decrypt a password-protected archive, a common tactic to bypass security gateways.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=team+fortress+2+hat+generator+v5+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4427780/normal_6063761022dc7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4367294/normal_600058702b7a3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412588/normal_6036ac3e99df0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482623/normal_5fc72a170c1e8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459185/normal_6054acd215936.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426090/normal_5fe7a1948ecdf.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4481990/normal_5ff018d754e67.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4428335/normal_5fc5f31b4c891.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476927/normal_603a09679cf35.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412607/normal_606bcb4dacd98.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0dad07d5-4c1a-4c1e-a19a-26a915a92001/what_groups_made_up_the_first_and_second_estates.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f18ce252-1e3f-419b-a7ec-0d67d0500471/9214327051.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee364be5-8a63-4b32-ba9c-220f6f7e5c1f/average_salary_masters_in_counseling_psychology.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ed6f974f-29f3-4451-855c-8b5aa02dbaa7/yamaha_mg102c_manuale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f10aebcd-57aa-4e78-b3d2-8e47128445d4/yamaha_rxv379_remote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66914046-215c-46dd-8bb4-adf203ddca87/wumukazix.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/05a04f27-df17-4224-a693-37e20b79646f/zuperavaxiguradabilefizug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fec660b-9619-4f5c-8edd-ee775677fde1/sarah_j_maas_a_court_of_thorns_and_roses_book_5_release_date.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ddbc52f-8174-4251-9fab-3dd9218ca1f9/kujosoroniwuwimawomum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6203c1de-487a-498f-a3da-37916832bc9b/cuisinart_coffee_on_demand_stainless_steel_12-cup_coffee_maker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4fbb59e-eb66-44bb-bc56-032c5567af5a/baldurs_gate_2_enhanced_edition_best_build.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d0eb87a-93a5-4b3a-a408-e32f3ba85f17/convert_midi_to_sheet_music_online_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48a0a240-3e85-4b12-b2eb-d8b5b0138fd8/57973198346.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9aa5a115-c76b-41cb-a872-d2d24587a016/theory_of_moral_sentiments.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f5d9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5D9 | 5676 bytes |
SHA-256: aac2efc1ddebeb6e6a9d5c97e5eb0c7c013dc1ca991552f51c3f03dee3575a12 |
|||
font_01_sfnt_off0001091a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1091A | 11532 bytes |
SHA-256: 95eae55f353061026dfed57048e67ae1e4d57afa530f38b1f6287316b24dff98 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.