MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which is presented in the document body as a 'millermatic 130xp parts diagram' to entice clicks. The presence of embedded URLs suggests an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/wix?keyword=millermatic+130xp+parts+diagram
- http://padlamadla.site/gsheet_query_date22gl8.pdf
- http://zoompol.xyz/wakuxonijamoxavatiwosexak78vd9.pdf
- https://cdn.sqhk.co/biloriput/mgf3Ggh/nufejotikunaduroto.pdf
- http://pc-remont.website/28765385941n9t0o.pdf
- https://cdn.sqhk.co/ditamozulipo/hctPHig/18865154830.pdf
- https://zinaxavum.weebly.com/uploads/1/3/4/3/134354277/finodo_xagexabixawesel.pdf
- http://fitokaps.xyz/starting_my_life_with_you_quotesedt79.pdf
- https://cdn.sqhk.co/jovojatubo/MhgcPge/69446450977.pdf
- https://fisezogidegogef.weebly.com/uploads/1/3/2/3/132303301/govisutimakisituka.pdf
- https://wepusiviji.weebly.com/uploads/1/3/4/6/134661614/wamajurepijodivus.pdf
- https://cdn.sqhk.co/menodotitit/1ibe4hd/basic_elements_of_design_texture.pdf
- https://cdn.sqhk.co/numobelez/ghfJjh1/lagu_medot_janji_cover_koplo.pdf
- https://cdn.sqhk.co/rufopunuk/7srjchi/48765197632.pdf
- http://susobokilodos.iblogger.org/is_the_honest_company_baby_shampoo_safe.pdf
- https://fufukarebalomok.weebly.com/uploads/1/3/4/3/134352968/rarusisowaxi.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f5ff543a-a2d3-4d37-9e52-24b2fc4d33ec/jegoniridaluj.pdf
- http://zovogimobidel.rf.gd/angular_bootstrap_form_in_modal.pdf
- https://uploads.strikinglycdn.com/files/4a331b3f-0965-4686-ae5d-a72420b08e14/50937723445.pdf
- https://uploads.strikinglycdn.com/files/6a3aeb98-e7cd-4e94-a23d-428f2a1fc000/black_no_more_book_summary.pdf
- http://baromar.epizy.com/vepizoxize.pdf
- https://uploads.strikinglycdn.com/files/a79e6d03-a025-44e1-99d4-b8163ed64bb1/why_isnt_my_canon_printer_turning_on.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ccca.bin55ceacf0100f7e5e8579a2a4bee5f4c58cd308412fef0bb9a7e275f7c2490852 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCCCA | 5824 bytes |
font_01_sfnt_off0000e095.bin21f65af1785fedc6da95d20b0016d67dcdf9f91a7230bd49fc1952e73042c0cf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE095 | 10344 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.