MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that uses a lure of a 'Toro lawn master 2 manual' to disguise its malicious intent. It contains an embedded URI that redirects to a URL associated with phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate maliciousness, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=toro+lawn+master+2+manual
- https://cdn.sqhk.co/posukomokufi/PbHljcN/17740901264.pdf
- https://cdn.sqhk.co/luridixajix/b3icibW/autograph_movie_songs_._com.pdf
- https://cdn.sqhk.co/mipekakiri/Cggngfm/vabupafuraxetovobifux.pdf
- https://cdn.sqhk.co/wufevinek/ijhfggp/cash_app_says_debit_card_not_supported.pdf
- http://jalazekesofijot.medianewsonline.com/zawiminamuvebadigibito.pdf
- https://cdn.sqhk.co/mozoposowi/hckhhzr/furefeziwuw.pdf
- https://cdn.sqhk.co/tajixixejafi/jfihJhe/lexamexigij.pdf
- https://cdn.sqhk.co/zutujodara/uFlhfig/banque_cantonale_neuchateloise_annual_report.pdf
- https://cdn.sqhk.co/purawewus/jihajeH/boom_beach_hack_apk_ios.pdf
- http://dezimazokuxulil.mygamesonline.org/lokuxijoforodevegolota.pdf
- http://rivilidopu.medianewsonline.com/beatles_songbook_chords.pdf
- https://cdn.sqhk.co/demanajinu/1gghh2N/89862000682.pdf
- http://nibakelenixezas.getenjoyment.net/nursery_rhymes_for_babies.pdf
- http://dusikazo.mypressonline.com/mathematics_important_formulas.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://xomapagovujux.atwebpages.com/bofoki.pdf
- http://jadivepijuga.myartsonline.com/53685265334.pdf
- https://s3.amazonaws.com/zopenave/historia_del_escudo_de_costa_rica_para_nios.pdf
- https://s3.amazonaws.com/mukutud/cat_vs_dog_fight_videos.pdf
- https://s3.amazonaws.com/pululusodogi/2007_dodge_caliber_sxt_repair_manual.pdf
- https://s3.amazonaws.com/jivagajamav/ielts_writing_tips.pdf
- https://s3.amazonaws.com/tetenifeme/65931073554.pdf
- http://xasagode.myartsonline.com/nsk_bearing_nomenclature.pdf
- http://wutesejib.onlinewebshop.net/68382120501.pdf
- http://naranosufok.atwebpages.com/6782789025.pdf
- http://revudipepofaten.myartsonline.com/wodivozerivubalarefedujug.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d2f0.binfbb413f7b0c5ba3067fd3e5455bce90d125ec2f475954d2ec779c59f81b5875e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD2F0 | 5004 bytes |
font_01_sfnt_off0000e3eb.bin1e3cd49508d9b898786826657409ddd3a7891b38a3b0ae1c1ead91c00e2b5105 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3EB | 10564 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.