MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URI pointing to a suspicious domain, and ClamAV detection confirms it is a phishing trojan. The document body, though heavily obfuscated, appears to reference a 'Russia football world cup schedule pdf', suggesting a lure to entice users to click the malicious link. No scripts were extracted, but the presence of an external URI and the phishing detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9748
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=russia+football+world+cup+schedule+pdf PDF link annotation
- http://fituxem.sportsontheweb.net/gemupozivukuxo.pdfIn PDF document text
- http://gosoxegekiri.mywebcommunity.org/61495550129.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dewazewokib/wutelegiwuda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/715ab229-1219-40f4-9a7f-a5c997f80b88/difasar.pdfIn PDF document text
- https://s3.amazonaws.com/fadedosi/arctic_animals_printable_worksheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d971a300-ac9d-4b47-80dd-87ce095cb236/harry_potter_wand_quiz_pottermore_questions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f4f4cfc-8e34-4b60-aacd-f8bde30934ff/56136305343.pdfIn PDF document text
- https://s3.amazonaws.com/kakekojezutok/how_to_use_canon_ij_scan_utility_mac.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96a2699f-e6b2-4cd7-9101-8b3da43aa299/how_to_make_origami_crane_steps.pdfIn PDF document text
- https://s3.amazonaws.com/wamatasamegu/cursive_letter_e_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/navoburarovada/70550134297.pdfIn PDF document text
- https://s3.amazonaws.com/pisik/apec_2018_png.pdfIn PDF document text
- http://nejesezape.myartsonline.com/35824337505.pdfIn PDF document text
- https://s3.amazonaws.com/sagotomagin/xukulexi.pdfIn PDF document text
- https://s3.amazonaws.com/midizaxopazeji/23684946208.pdfIn PDF document text
- https://s3.amazonaws.com/patilawasu/dd_3.5_complete_warrior_feats.pdfIn PDF document text
- https://s3.amazonaws.com/retisovojor/spotify_pro_apkpure.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ff2d5fa9-8cf1-4b55-87ef-d43b33f42be5/3406770472.pdfIn PDF document text
- https://s3.amazonaws.com/pafiganovavi/kajikexukeratet.pdfIn PDF document text
- https://s3.amazonaws.com/dalava/50063773989.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0de6ed7d-4149-4be8-a10c-8fc4f4df88b7/jivupati.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29fc793a-85a9-4301-881d-3ac70256791e/dinunozowel.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000243f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x243F6 | 5480 bytes |
SHA-256: f0f874534732ef0b5300f9a561094672cf07efc234723f776fe14833e9f2c2f8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.