MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://jacksth.ru/wix?keyword=dong+hee+son', which is a strong indicator of a phishing or malware distribution attempt. The PDF structure and embedded content suggest it's designed to exploit user trust, aligning with spearphishing tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/wix?keyword=dong+hee+son
- http://bajifepeselok.sportsontheweb.net/arabic_to_english_dictionary_free_download.pdf
- https://povewagefafede.weebly.com/uploads/1/3/4/8/134888055/01b6749f92513f.pdf
- http://padojobimo.mywebcommunity.org/lanetefi.pdf
- https://ritipovilij.weebly.com/uploads/1/3/4/6/134650849/mimuwuwixigajovediwi.pdf
- http://zagozogenef.sportsontheweb.net/38425851528.pdf
- https://mudagetani.weebly.com/uploads/1/3/4/3/134381332/tasik_nuwuje.pdf
- http://sizegoduxuxa.mygamesonline.org/luminowiwuxoto.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://jisijuvod.myartsonline.com/mental_status_examination_form_free_download.pdf
- https://s3.amazonaws.com/xakapudakadu/loviribe.pdf
- https://uploads.strikinglycdn.com/files/cb50b02b-5bad-4fee-b200-104298e94620/what_are_the_best_needles_to_use_for_machine_embroidery.pdf
- http://xekazaz.myartsonline.com/xosom.pdf
- https://uploads.strikinglycdn.com/files/2d8f55d2-91a2-4d8c-8c63-8cb09ab74f92/4462276504.pdf
- http://wufagezigedo.onlinewebshop.net/white_christmas_tree_lights_walmart.pdf
- https://f9c81679-ddb1-4746-ab40-32673edc426c.filesusr.com/ugd/2eff39_00a8de39d3594857aa2b3e9cb3ee345d.pdf?index=true
- https://9f349447-249b-4747-956a-316fe86e371b.filesusr.com/ugd/d2b720_47ca83d82c454beebb5756a60149415d.pdf?index=true
- https://s3.amazonaws.com/dibedamoka/is_my_hp_officejet_4500_airprint_compatible.pdf
- https://uploads.strikinglycdn.com/files/4742c37a-e3b1-4890-830a-3c4286d7d95b/dish_tv_non_stop_pack_2021.pdf
- https://s3.amazonaws.com/pubopelej/dance_with_me_house_song.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb33.bine464271442536b5629b8d8e8a414b416be973334a80194358179417edde7dca9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB33 | 4080 bytes |
font_01_sfnt_off0000f9c8.bindb65ed61ec86eda640cea581ce2a846635373fc1228d21007a5a201e98ea52ef |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9C8 | 4608 bytes |
font_02_sfnt_off00010984.binc11dba3d0ea50bae13241a633e4d9850b920199327953702435555a5b8929952 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10984 | 12840 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.