MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains embedded URLs and is flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, suggests a lure related to 'agv automated guided vehicle ppt', directing users to external sites like https://ponafet.ru/123. No scripts were extracted, but the presence of external links and the phishing detection point towards a phishing attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/123?utm_term=agv+automated+guided+vehicle+ppt
- https://jazelufum.weebly.com/uploads/1/3/5/9/135965355/nuvivid_lexofutuvowupav.pdf
- http://unlockdeals.shop/vocabulary_workshop_level_d_answers_unit_11y5wcd.pdf
- https://verumoxozuvije.weebly.com/uploads/1/3/1/4/131407377/nomegokokapa.pdf
- http://zeropium.com/can_i_control_my_dvd_player_with_my_xfinity_remotec0mcw.pdf
- http://ighelperscenter.com/225713818053aypl.pdf
- http://kovamuwaropepu.getenjoyment.net/kupunidu.pdf
- https://nupanirosum.weebly.com/uploads/1/3/4/8/134858368/9ba61.pdf
- https://mabobuloxulekev.weebly.com/uploads/1/3/4/6/134692970/124e53d7de53.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d07d4355-8859-4144-9ea8-591489b047fc/novezevemesuminuniwi.pdf
- https://s3.amazonaws.com/tobito/kinizutinit.pdf
- https://uploads.strikinglycdn.com/files/cefbb203-2b02-4332-bb4a-88bbaeb5a81d/how_to_catch_him_and_keep_him.pdf
- https://uploads.strikinglycdn.com/files/8e8dd482-bd36-4302-9a0b-956da380a72e/who_is_god_ks2.pdf
- http://fotizojorirepel.onlinewebshop.net/bracelet_montre_casio_3157_sgw-100.pdf
- http://fatofejeripise.rf.gd/modern_hebrew_alphabet_chart.pdf
- http://tigagatu.atwebpages.com/25080512024.pdf
- https://s3.amazonaws.com/winumigutam/antique_gregorian_sheet_music.pdf
- https://s3.amazonaws.com/metubevozisul/lds_temple_preparation_book.pdf
- https://s3.amazonaws.com/wixatax/does_ocd_get_better.pdf
- http://melaganotig.rf.gd/adawat_novel_free_download.pdf
- http://tetizawoto.rf.gd/gosukuj.pdf
- https://s3.amazonaws.com/fejififimaketo/what_does_seasonally_adjusted_cooling_capacity_mean.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e23d.bin744d2a749c2529124fe5cb0528d72c8113eff509d8928bbdc4cb5c1b3471351b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE23D | 5260 bytes |
font_01_sfnt_off0000f40e.bin555ae6e1079833d2f5848c4fe4f16f5cca6fe1ae8ef4c51f3c9dbf0e8b2218b7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF40E | 11112 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.