MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support the malicious nature of the file. The document body, though heavily obfuscated, appears to be a lure related to song lyrics, likely intended to trick users into clicking the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/wix?keyword=for+those+tears+i+died+lyrics+and+chords+pdf
- http://refukifis.22web.org/bibewewezakigodezapodubem.pdf
- http://gegejobusi.22web.org/8721752323.pdf
- http://xodinazafomizi.22web.org/napivepuxamoferonojatima.pdf
- http://reabook.online/intermec_pm4i_driver_windows_7rqnbk.pdf
- http://odemebayisitrafik.com/xemesiwosikevizimiltoga5.pdf
- http://aydym.club/337243756092jnnd.pdf
- http://pafiwuz.66ghz.com/bluestars_prophecy_chapter_1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://jivobolalozula.rf.gd/din_en_iso_12100-_1.pdf
- https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_6445a78a4030415b9c85f60c228978f3.pdf?index=true
- https://uploads.strikinglycdn.com/files/733597be-f55f-4076-ba60-1f50ec3c3ed9/rumisepavokol.pdf
- http://vemevusakeke.epizy.com/kerel.pdf
- http://zowisojaba.epizy.com/jifoguwovozevefadux.pdf
- https://uploads.strikinglycdn.com/files/6023f2ed-46ab-470c-8893-e1f6a186c312/36505653238.pdf
- http://juxonarevat.rf.gd/bar_graph_questions_and_answers.pdf
- http://kabekexivebinef.epizy.com/blue_parrot_bird_picture.pdf
- https://d17f4099-ecc1-42b1-9c73-51521793457c.filesusr.com/ugd/4a2613_b3f75d8ea49444588c4847ff1c54afa9.pdf?index=true
- http://virixavop.epizy.com/46452777749.pdf
- https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_3a696e9071254ed2b20e06b1ec150b4c.pdf?index=true
- http://lepevalir.rf.gd/91556692043.pdf
- https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_6c622ed8421d43b2aeea5253a41da2cd.pdf?index=true
- https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_6788e16a596b47b38e698c4bc6faf33c.pdf?index=true
- http://wovefekekixuji.rf.gd/lenumu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d687.bin10a7d802d99c8e51669674c04bac293fb27aaa43ab6a9cc8dceac2a701d21037 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD687 | 5300 bytes |
font_01_sfnt_off0000e896.bin4aaff03a07012eb8b4982ec53df724316b782b3407d91599dcc197971e0ac9aa |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE896 | 10504 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.