MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading further malware or phishing for credentials. The document body, though heavily obfuscated, suggests a lure related to a specific book title, likely to increase user engagement.
Machine Learning
- Nyx PDF Classifier malicious score 0.5250
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/award?keyword=aleister+crowley+book+4+part+1+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4451205/normal_603e4651e3a4f.pdfIn PDF document text
- https://cdn.sqhk.co/dukosisevu/DngeJja/within_temptation_what_have_you_done_wiki.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418984/normal_6008b19162a55.pdfIn PDF document text
- https://suzazega.weebly.com/uploads/1/3/4/4/134476369/forivod_rixej_tusukusafakijot_pubiz.pdfIn PDF document text
- https://cdn.sqhk.co/tojebaru/hCghtHt/ted_cruz_twitter_subpoena.pdfIn PDF document text
- https://kafaziwe.weebly.com/uploads/1/3/1/0/131070109/genabadedisibusuxe.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470982/normal_5ff65ce029b65.pdfIn PDF document text
- https://difanewoxapazu.weebly.com/uploads/1/3/5/3/135321324/7907465.pdfIn PDF document text
- https://cdn.sqhk.co/zidulibu/ohihjlm/jufeg.pdfIn PDF document text
- https://kafedujewerom.weebly.com/uploads/1/3/4/6/134622586/rerejuposigu-dijobutoju.pdfIn PDF document text
- https://cdn.sqhk.co/xovikojux/ijpsUhh/clash_of_clans_wiki_walls.pdfIn PDF document text
- https://cdn.sqhk.co/tamurikubol/phaLVhh/dakifaziwiberisiluxasarix.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://ab737b70-891a-4a1f-8db9-ee548211cb31.filesusr.com/ugd/ce14f3_397eacef68dd403fbab0c0df7eb8f93a.pdf?index=trueIn PDF document text
- https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_bbbc682b731b4e519c0d03c4958fa7c9.pdf?index=trueIn PDF document text
- https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_060aae0c3c124f688e52b6401f382733.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4fab0a4e-cc7d-4846-829d-0345fe702a0a/61858881518.pdfIn PDF document text
- https://492f55f4-3442-4b37-b17e-39d9f2f0ae8a.filesusr.com/ugd/7dfe85_d93cee698c174a8596b731236a7bdd74.pdf?index=trueIn PDF document text
- https://7e574f8b-ef34-4833-8dee-b18f3ac9fc91.filesusr.com/ugd/af8ffd_b134065a3dfa4bab8425227cb46da003.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ecd6e9b6-2ee3-4e0e-82b5-0dd27b910134/nugaz.pdfIn PDF document text
- https://451cdc1f-766e-44a1-8a9d-f9db2ecad5ed.filesusr.com/ugd/0f0d48_cede4526e2d849bf8720549cdd629ff0.pdf?index=trueIn PDF document text
- https://77ac2d45-d533-4b4b-a85c-01e81860bff9.filesusr.com/ugd/7f1ad7_60617c70409c4452a2e0ce47ff5ccd6f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5cb4cdfe-627d-4080-ac90-a525a202e92e/who_were_the_nobles_in_france.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/812202a5-3811-4532-b23d-aa507bc60522/fijaj.pdfIn PDF document text
- https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_ce72cafbfd55414cb6331868390e0b60.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3135684f-5d20-4717-8787-cf93e2a9e23e/ronald_wright_a_short_history_of_progress_summary.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000d5365.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD5365 | 5676 bytes |
SHA-256: 03ce0b19e068c04d296eb0a9fb4135c3fbbbb2b8741944d9ae88e6b7628df474 |
|||
font_01_sfnt_off000d66ea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD66EA | 22436 bytes |
SHA-256: d51787c7fb9e4cf8a37414e3f1c26bfcbabf6025ff94211d06f97e86ba0f3f15 |
|||
font_02_sfnt_off000dac50.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDAC50 | 16088 bytes |
SHA-256: 3c1c7bd747a9a8f6e1c531457064e9378d9a893e5271ac7381d9d0015290d8f4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.