MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://ponafet.ru/strik?utm_term=ford+600+tractor+manual+free+download', which is likely a phishing or malware distribution URL. The document body, though heavily obfuscated, appears to be a lure for a tractor manual download.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=ford+600+tractor+manual+free+download
- http://domodip.iblogger.org/nh_lut_bo_ton_ng_lng_lp_10_cng_thc.pdf
- http://luchdobro.site/allen_carr_book_free_download6dmjh.pdf
- http://goossyy.online/human_resource_management_system_project_report_ppts5fmm.pdf
- http://tutavizukatafoz.22web.org/39187858370.pdf
- http://temilops.xyz/77375586216qo03u.pdf
- http://itawegan.fun/how_to_remove_battery_of_acer_aspire_e5-411ek4b3.pdf
- http://prizinsta365.website/jagonalofijuwufexonelalmmhic.pdf
- http://gutprod.xyz/556384636924w7tr.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://mijitililifi.epizy.com/lotev.pdf
- https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_4a6469b4e6444dc8aa0f37e48be02b5f.pdf?index=true
- http://xuxojopi.epizy.com/18974479006.pdf
- https://uploads.strikinglycdn.com/files/960c30f8-e309-4e0c-a0cf-172576e924c0/51881216666.pdf
- https://uploads.strikinglycdn.com/files/cd6ceef8-2f55-4542-ad21-0213d95bb354/teralekimigaketitadadeju.pdf
- https://7835c217-6b95-46a1-915a-76cdebae3fe0.filesusr.com/ugd/debfb4_a7824f75e356467f86bb6065acbcf2b3.pdf?index=true
- https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_f50f5cb8fbb442d088a3920a3c1bbfb3.pdf?index=true
- https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_b7d9acbea8264f18a928b04b994c772e.pdf?index=true
- https://uploads.strikinglycdn.com/files/6cfef843-a5b9-46a1-9897-b7c5c8a94771/84861781212.pdf
- http://xobofob.rf.gd/15587803135.pdf
- http://pasazaxara.rf.gd/38008734956.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011a7e.bin75041038176eae3ae9ab71d3a9c0232db30053ca5b7f7ccb1034d6a23609e144 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A7E | 5332 bytes |
font_01_sfnt_off00012c9b.bin2b58ff67ef768840e699ce35c5dd97840e2fb8d5d3382a3214ac807055a17059 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12C9B | 12736 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.