MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result for a game download, indicating a social engineering lure. The presence of embedded URLs and the nature of the detection suggest an attempt to trick users into visiting a malicious site, likely to download further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://huntic.ru/pbw?utm_term=wwe+smackdown+here+comes+the+pain+free+download+for+android
- https://kogoporerosuf.weebly.com/uploads/1/3/5/3/135322240/9958521.pdf
- https://gipurafesab.weebly.com/uploads/1/3/1/6/131637457/razonupeno.pdf
- https://rojofasefimo.weebly.com/uploads/1/3/1/6/131636828/fee15c8447fd.pdf
- https://cdn-cms.f-static.net/uploads/4411916/normal_5fd1778aecfc2.pdf
- https://cdn-cms.f-static.net/uploads/4446642/normal_6024ef67c5c2b.pdf
- https://kelodulelonax.weebly.com/uploads/1/3/4/6/134644310/fbdebc9370d5c2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://wuxikadafi.pbworks.com/w/file/fetch/144420903/is_there_an_equalizer_for_spotify.pdf
- http://viluxese.pbworks.com/f/contoh_judul_skripsi_akuntansi_pajak.pdf
- https://uploads.strikinglycdn.com/files/8ae212a7-962f-4dff-8225-b7f3526297b8/gaboze.pdf
- http://sufizilofab.pbworks.com/f/what_is_capsule_filling_machine.pdf
- http://paderukut.pbworks.com/f/avital_7111l_remote_start_instructions.pdf
- http://lekipirunezi.pbworks.com/f/why_am_i_not_getting_all_my_freeview_channels.pdf
- http://fagimox.pbworks.com/f/dudufewetoxaligazewitiget.pdf
- http://kekirow.pbworks.com/f/does_sauna_belts_really_work.pdf
- http://siruzosu.pbworks.com/w/file/fetch/144446715/how_to_install_dlc_gta_v_ps3.pdf
- https://uploads.strikinglycdn.com/files/4a8ebe75-ee36-47f3-9729-373d85a29a3a/58701573884.pdf
- http://gazumadu.pbworks.com/f/82732134899.pdf
- http://paderukut.pbworks.com/f/download_wwe_2k16_for_pc_highly_compressed_99mb.pdf
- http://mudowomuxexo.pbworks.com/f/pijejodesafa.pdf
- http://bupataved.pbworks.com/w/file/fetch/144427932/nasuwesin.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ead7.bine3709b73d03fe3ec4b335d1ef04d43961ec172860428509312b56ac1a822d367 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAD7 | 5564 bytes |
font_01_sfnt_off0000fdb1.bin112b26fc88950e1d5114620bbd3d055b8ef08b3baeca6775256b838c263d2c2e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDB1 | 11668 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.