MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The embedded URL, https://seumenha.ru/strik?utm_term=d%2527link+ac3200+range+extender, suggests a lure to a malicious site. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a phishing attempt, likely delivered as a spearphishing attachment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=d%2527link+ac3200+range+extender
- https://cdn-cms.f-static.net/uploads/4425230/normal_60140aec28f3d.pdf
- http://ruvogodozipabiv.scienceontheweb.net/bangla_book_class_5.pdf
- https://tunawirivam.weebly.com/uploads/1/3/1/4/131437064/2806635.pdf
- https://cdn-cms.f-static.net/uploads/4475741/normal_5fd8ba3a41a6b.pdf
- http://gejudoxe.mypressonline.com/asthma_action_plan_for_school.pdf
- https://cdn-cms.f-static.net/uploads/4444882/normal_601471eab4701.pdf
- http://juwupexutaval.mywebcommunity.org/libotumapevaxu.pdf
- http://melidagerukebel.sportsontheweb.net/fundamentals_of_cost_accounting_3rd_edition.pdf
- https://pevopuxavinedun.weebly.com/uploads/1/3/1/4/131406680/gesoxuxilixitu.pdf
- https://mitemulesebiped.weebly.com/uploads/1/3/4/4/134479511/6f9a697eb0edd2.pdf
- https://static.s123-cdn-static.com/uploads/4419191/normal_5fc5cc8ba5265.pdf
- https://pujosudenavi.weebly.com/uploads/1/3/4/5/134508056/nikom_zekuzasijogok_fetonumetiva.pdf
- https://nebutoribuve.weebly.com/uploads/1/3/4/6/134615115/624677.pdf
- http://mufutekuson.getenjoyment.net/muwasubaw.pdf
- https://cdn-cms.f-static.net/uploads/4450746/normal_6062c0747fcd0.pdf
- https://static.s123-cdn-static.com/uploads/4484364/normal_5fcba19b04157.pdf
- https://mipedurekarano.weebly.com/uploads/1/3/5/3/135321071/a56797.pdf
- https://monivewuvafa.weebly.com/uploads/1/3/4/0/134096064/diwetunebojaj_mufizawe_vojamizutogo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lorugipopuxe/c._difficile_treatment_guidelines.pdf
- https://s3.amazonaws.com/kovezux/how_many_questions_are_on_the_license_test_in_nc.pdf
- https://s3.amazonaws.com/gisujubolidine/91347291930.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ff91.bin60d18a46d3515ac48f42302c2b95911dc064dc1ff4ba1c5f2f45515bdb12ba65 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF91 | 5532 bytes |
font_01_sfnt_off0001128c.bin412f9bd108f9da845b5ba2f0c3d78f003cb93cbe1ba66d44ee176f67a25d80c6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1128C | 11336 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.