MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'soxebez.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, suggests a lure related to 'adaptive defense 360 pdf'. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/award?keyword=adaptive+defense+360+pdf
- http://fastdonwload.space/53743096651lctjr.pdf
- http://arboozfilm.com/haughtiness_crossword_answerskpk5.pdf
- https://gutinevar.weebly.com/uploads/1/3/4/6/134611255/583c28122.pdf
- http://znatural.space/what_causes_darkened_teethwdqqo.pdf
- https://jekosupoma.weebly.com/uploads/1/3/1/6/131637113/setelu_kimoxibakeg_waxavo.pdf
- http://lixodamevurobar.mygamesonline.org/what_are_the_elements_of_psychoanalytic_theory.pdf
- http://tumbochka.space/406009297595lrgw.pdf
- https://relowuforobelo.weebly.com/uploads/1/3/4/5/134528439/37ced0.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bujekotu.atwebpages.com/89759486335.pdf
- http://zuputes.atwebpages.com/how_to_install_fleck_5600_water_softener.pdf
- http://guzadexogemadev.rf.gd/67558084604.pdf
- http://ridibob.epizy.com/samples_machine_learning_algorithms.pdf
- http://kawerulim.onlinewebshop.net/do_plants_need_cool_or_warm_humidifier.pdf
- https://uploads.strikinglycdn.com/files/da819a1f-cd50-4ff3-b1e8-dca9e813c8b8/how_much_do_district_attorneys_make_in_los_angeles.pdf
- https://uploads.strikinglycdn.com/files/7781de06-74be-46e7-83eb-6e46be44ec1f/how_much_does_it_cost_to_replace_a_washing_machine_belt.pdf
- https://s3.amazonaws.com/rijaliwiguvex/95330381431.pdf
- https://s3.amazonaws.com/fifuto/mallow_weed_herbiguide.pdf
- https://s3.amazonaws.com/dojivewobasuval/78950140319.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e5be.bin81cc926e60ef775a4c3ba67e823cb171e7227686f0065c2c5e49d20bdc22e5a4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE5BE | 5416 bytes |
font_01_sfnt_off0000f843.bindce3148fc9d56068bad748b36b2ac6ffcf21d90747b2e2bf4f21471f2f6ee1c1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF843 | 10820 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.