MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains embedded metadata and heuristics indicating it is malicious, specifically flagged by ML classifiers and ClamAV as a phishing trojan. The document body, though heavily obfuscated, contains strings that suggest a lure related to a 'Kenwood car stereo manual'. The primary IOC is an external URI pointing to 'traffine.ru', likely intended to host a malicious payload or phishing page.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffine.ru/strik?utm_term=kenwood+car+stereo+manual
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static1.squarespace.com/static/5fc793808c9e503d27aa85e4/t/5fcec13f64290b1c3dc26c97/1607385408029/offroad_climb_racing_adventure_chests.pdf
- https://static1.squarespace.com/static/5fc0e9036b97992eb55c1f46/t/5fc19e619ee0f32b879021db/1606524513230/procom_30000_btu_heater_manual.pdf
- https://static1.squarespace.com/static/5fc0bebbcd1e280355d37542/t/5fc14307eaf37e3b64ca51bf/1606501129157/67441412911.pdf
- https://static1.squarespace.com/static/5fcefd143d778404109110a2/t/5fd6c73172b1137fa98552e8/1607911218448/where_is_chyme_formed_in_the_body.pdf
- https://s3.amazonaws.com/povodijirig/59889920963.pdf
- https://s3.amazonaws.com/veraxawewib/nasinudekuvokikoziwul.pdf
- https://static1.squarespace.com/static/5fc4f173f9866f3fd2ede135/t/5fd0cd2b1c49363a9b536ba0/1607519536711/majijopogufisa.pdf
- https://static1.squarespace.com/static/5fc290cdf9866f3fd2dedb6b/t/5fc5f94d3c02f22b9dda4360/1606809934401/walter_m_kennedy.pdf
- https://static1.squarespace.com/static/5fc0de9c5bcb0228a2825217/t/5fc372dc3485235c86331b1a/1606644446372/21_day_fix_dvd_walmart.pdf
- https://static1.squarespace.com/static/5fbfceb2c14dfd36feeb11ef/t/5fc100487acac6192ae471bf/1606484040720/zitorisaliwugizedowagol.pdf
- https://static1.squarespace.com/static/5fc4ecf2df132613bbd760b1/t/5fceb4c9e985de26310023c9/1607382218088/39417157338.pdf
- https://static1.squarespace.com/static/5fc6bbbad64a3343a5f3c99d/t/5fd17675ce71ee580fa098e4/1607562871125/metanuvadiborubonujusan.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c727.binf71f658346b1a9a68fcc5c409b28a9f5baa1b06f82e83b19b77dbdaaaf0069f2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC727 | 5148 bytes |
font_01_sfnt_off0000d8a8.bin2aa88462903d1832ae540b8da5378034ba3829d49214728b552707c197dd6a03 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD8A8 | 11960 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.