MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The document body, though heavily obfuscated, suggests a lure related to 'Karcher pressure washer k4 instructions'. The presence of multiple external URLs, including 'https://ponafet.ru/aws?utm_term=karcher+pressure+washer+k4+instructions', strongly suggests these are used to host or redirect to malicious content. No scripts were extracted, but the PDF structure and external links point towards a phishing or downloader attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/aws?utm_term=karcher+pressure+washer+k4+instructions
- http://dotekebenutedex.scienceontheweb.net/85333361197.pdf
- http://kilijosizujowo.medianewsonline.com/anandalok_pujabarshiki_2020_free_download.pdf
- https://cdn.sqhk.co/tupipitijil/p59zbhh/pifanubabetepaxin.pdf
- http://nigemutekilum.mypressonline.com/kelaxojasilix.pdf
- http://xubajur.mygamesonline.org/bioethics_definition.pdf
- http://nekidifuton.medianewsonline.com/mavudipijisanukowukijetek.pdf
- https://cdn.sqhk.co/libudezetuv/chfBjd9/spacedraw_apk_free_download.pdf
- http://pifofobexaxel.mypressonline.com/nalotopaxuwi.pdf
- http://judupebe.getenjoyment.net/brand_guidelines_book.pdf
- https://cdn.sqhk.co/zofizitene/LDjhibZ/crash_arena_turbo_stars_hack_online.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://6e337ffa-6c75-4e98-916f-0cab85e7e3f5.filesusr.com/ugd/a22560_23361326d546456b89bfceb7f9cb9216.pdf?index=true
- https://s3.amazonaws.com/xugigabitulu/java_8_stream_filter_null_safe.pdf
- http://puribisipup.atwebpages.com/tom_apostol_calculus_vol_2_solutions.pdf
- https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_cbe424dc55cf47309ab7e85e14e292c5.pdf?index=true
- https://s3.amazonaws.com/pexodugosa/google_sheets_conditional_formatting_range.pdf
- https://s3.amazonaws.com/lizuseguwix/hematopoiesis_histology.pdf
- https://e2a12503-e9f4-4898-9b1e-00959bf5a9c8.filesusr.com/ugd/1f0de7_6ed08b62cd43417a9219b5cd140ce4ff.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f494.bin9d29d40854c8dfedec6008b4a111432433d7247a9d4bf6db1ba062012ff59be4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF494 | 5200 bytes |
font_01_sfnt_off00010659.bin6c19f608dfa2946034299af4a5e7ef90af253151837ebab9283819f1cba3489a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10659 | 11124 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.