MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The sample was identified as malicious by an ML classifier and exhibits characteristics of an advance-fee scam, including lottery and parcel delivery lures. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site or download further content. No scripts were extracted, but the presence of the advance-fee scam lure and external URLs strongly suggests a phishing or social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=downtown+mafia+cheats+iphone
- https://static.s123-cdn-static.com/uploads/4479673/normal_600639771c01b.pdf
- http://gisoboxizaza.mygamesonline.org/35782031399.pdf
- https://static.s123-cdn-static.com/uploads/4443595/normal_5ffb147d431a9.pdf
- http://tesekal.mygamesonline.org/mini_cooper_dealer_near_me.pdf
- https://cdn-cms.f-static.net/uploads/4454277/normal_600ce14ebf8bd.pdf
- http://dipazekonowa.mypressonline.com/mozaxasezaruvakozuropude.pdf
- http://freshka.fun/tulukegekugesogoxuwi51ng5.pdf
- http://mixutadumekaje.mypressonline.com/how_to_charge_3000mah_nimh_battery.pdf
- https://cdn-cms.f-static.net/uploads/4412780/normal_603555275a855.pdf
- https://cdn-cms.f-static.net/uploads/4470835/normal_5fd63f4030dc5.pdf
- https://cdn-cms.f-static.net/uploads/4451210/normal_6034f5a6c7087.pdf
- http://nibakelenixezas.getenjoyment.net/gixibagaxesalupudorerov.pdf
- https://cdn-cms.f-static.net/uploads/4450156/normal_5fda3ca5ccfa6.pdf
- http://riniwodifole.medianewsonline.com/denazulanap.pdf
- https://static.s123-cdn-static.com/uploads/4388062/normal_5ff6c80045300.pdf
- http://mojofaza.mypressonline.com/danugegukavisopul.pdf
- http://hellesypakk.online/lapawiganmi9ur.pdf
- http://nibajafij.medianewsonline.com/fusizuguniwajugufe.pdf
- http://kuviruvada.getenjoyment.net/lifutinozekosunu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://pogetowem.onlinewebshop.net/sunebareruzojezix.pdf
- http://vigexosav.myartsonline.com/how_much_does_it_cost_to_copyright_a_logo.pdf
- http://gupatevefojip.myartsonline.com/77140431901.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e592.bine6585f100e9a5bbccaf9e7aee543e1ac680a0e118856a992de725d2680bc9073 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE592 | 5220 bytes |
font_01_sfnt_off0000f74f.bin65462e6744a18212f642042a88bee6fd05b4c68cfc25b0f09d5e3abac45f6292 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF74F | 11576 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.