MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs are indicative of a lure to a malicious site, likely for phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/123?utm_term=auditory+learning+style+pdf
- http://rubewox.sportsontheweb.net/48474839063.pdf
- https://cdn.sqhk.co/gorubabor/ii0ifja/audio_bible_telugu_apk.pdf
- http://bestrongbyg.com/vokapubasumikabewlsb8c.pdf
- http://sukutoxuwurif.mywebcommunity.org/modowizazulatubulalefiz.pdf
- https://cdn.sqhk.co/sutekepape/TUwbhia/kowifinidekudobul.pdf
- http://7evenrp.ru/70948760253583wd.pdf
- http://tulomodev.getenjoyment.net/graphlab_python_3.6.pdf
- http://kudukudimox.sportsontheweb.net/how_to_set_timer_on_boiler_worcester.pdf
- http://peuly.xyz/causative_have_and_get_exerciseznvs9.pdf
- http://tk-time.site/48485280948armle.pdf
- https://cdn.sqhk.co/sisagoku/Cowjfwa/64764951109.pdf
- https://cdn.sqhk.co/fejavegiwo/9VHqUgg/fat_cat_jump_fail_gif.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vogonadebemumox.epizy.com/pathfinder_character_sheet_excel_template.pdf
- https://uploads.strikinglycdn.com/files/ddd32696-77ad-40dc-a832-e050aeacb4f4/pusegomero.pdf
- http://kupikobu.epizy.com/momirefigi.pdf
- http://zutadefado.epizy.com/tupowojagovadibod.pdf
- http://vupaguriwedizid.atwebpages.com/understanding_and_using_english_grammar_third_edition_answer_key.pdf
- https://uploads.strikinglycdn.com/files/3de7837a-78c1-4648-a5c6-8a52635a7685/my_license_says_not_for_real_id_purposes_nj.pdf
- http://boribasumagit.epizy.com/42511284128.pdf
- https://uploads.strikinglycdn.com/files/b998af76-8812-458f-83e7-b24cbc6532ad/what_characters_are_in_jump_force_deluxe_edition.pdf
- https://uploads.strikinglycdn.com/files/a9080885-4456-4908-b951-c9e308e2caba/86856432676.pdf
- https://uploads.strikinglycdn.com/files/40e5261c-3238-4c2e-8c3b-fabe8d338d00/onkyo_tx-nr616_7.2-_channel_network_a_v_receiver.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fafa.binaaf4991daa93b04b63c748fa1b3896e5eadd97250022d899419985b026e06d1c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAFA | 5300 bytes |
font_01_sfnt_off00010d1e.bin77040ba0e1c5b78c3e065bf4cc456846795876c518b2c42974eb0748f23595ce |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D1E | 10260 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.