MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a lure related to flight attendant salaries, which is a common social engineering tactic. It also contains an embedded URI pointing to 'nipisod.ru', a domain often associated with malicious activity. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=how+much+is+the+salary+of+flight+attendants
- https://cdn.sqhk.co/gowamojon/ijeiiig/paquete_de_iconos_arcade_daze_2_apk.pdf
- http://taforojujutusig.mygamesonline.org/65660935744.pdf
- https://cdn.sqhk.co/gogoturowib/bjcjjix/bleeding_love_song.pdf
- https://cdn.sqhk.co/dusivubeleza/aLSz8jd/ufc_254_fight_card_start_time.pdf
- http://tibudirowe.mygamesonline.org/rewrite_sentences_using_modal_verbs.pdf
- http://jetavof.sportsontheweb.net/how_do_i_connect_external_speakers_to_my_mac.pdf
- https://cdn.sqhk.co/tezofugowura/hc4Jmhi/firestorm_air_hockey_parts.pdf
- https://cdn.sqhk.co/turanexode/b8Ayhhp/garena_free_fire_booyah_day_download_obb.pdf
- http://kakafeg.scienceontheweb.net/bunker_hill_color_security_system_with_night_vision_-_model_60565.pdf
- http://pimifawimonidij.mywebcommunity.org/magnus_chase_and_the_ship_of_the_dead_audiobook_free_download.pdf
- https://cdn.sqhk.co/suxidixip/Kjika3X/kiditanarabunosazu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vafedoba.rf.gd/what_is_the_lucky_color_for_year_of_the_rooster.pdf
- http://bujekotu.atwebpages.com/dibujos_para_colorear_halloween.pdf
- https://s3.amazonaws.com/xazarujokemus/banawivuzegumidalajup.pdf
- http://resilasijajatil.myartsonline.com/55352559300.pdf
- http://taranupuzoxel.rf.gd/bokexudafovakatelefeforiw.pdf
- http://xefosep.rf.gd/83710162733.pdf
- http://vunanazon.rf.gd/android_os_features.pdf
- http://piwakitidi.onlinewebshop.net/gajaf.pdf
- https://s3.amazonaws.com/kakekojezutok/zulirumibil.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000102ba.bin8901d0830628a2b5a93d1eceeeb3702955662cdb9b01e345224828dd4f78cfe3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102BA | 5592 bytes |
font_01_sfnt_off000115a9.bin9a566eed26cb05cd0371d5a871a2d6cf1ea40206eabcc0a67705a09fbeb5b8a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x115A9 | 10616 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.