MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document is identified as malicious by ClamAV and an ML classifier, and it contains numerous embedded URLs. One prominent URL, 'https://ponafet.ru/wix?keyword=ancient+greece+study+guide+7th+grade+answer+key', is flagged as external. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is designed to host many links on disposable domains, suggesting a phishing or malware distribution scheme. No scripts were extracted, but the presence of external links points towards a phishing attack vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=ancient+greece+study+guide+7th+grade+answer+key PDF link annotation
- http://xakaderinetatu.mygamesonline.org/40930951246.pdfIn PDF document text
- http://rupebakonodeja.iblogger.org/19019021149.pdfIn PDF document text
- http://wikowezenitezo.medianewsonline.com/vesudogonufosu.pdfIn PDF document text
- http://dorulezebum.sportsontheweb.net/what_does_cloud_management_service_mean.pdfIn PDF document text
- https://cdn.sqhk.co/bexefoboxevi/jgejfib/32153763626.pdfIn PDF document text
- https://cdn.sqhk.co/xixujipum/fihihOo/mobowuwonosafefiwi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://4868a29a-6d77-448d-a9c5-bc5c6a1713c3.filesusr.com/ugd/060e50_c19c57c91e374abe8adfba3e6e5c2db1.pdf?index=trueIn PDF document text
- http://kizamamal.epizy.com/computer_programming_and_analysis_in_canada.pdfIn PDF document text
- https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_a8428dc593604a6bb6228537b6fcbe84.pdf?index=trueIn PDF document text
- https://24451074-f53b-4065-993c-779ba3957988.filesusr.com/ugd/0ae25f_df5a6898f77545fa93fe0af734d99c2f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a64347ff-b069-4923-86d8-69503f43d50c/what_is_norse_mythology_all_about_essay.pdfIn PDF document text
- http://wofajigu.rf.gd/hp_deskjet_3050_printer_airprint_setup.pdfIn PDF document text
- http://pikubub.onlinewebshop.net/how_to_do_the_google_thanos_trick.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f048b597-0762-4cfb-a306-5e5033b46d61/both_sides_now_chords_glen_campbell.pdfIn PDF document text
- https://5b949be5-44ef-49af-96c7-0ebaa8fe632e.filesusr.com/ugd/3402b1_50dd27d729884ffba75d7340f7c9e2eb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/dabcae91-24ec-4438-bcfc-0ddea25a7bb1/roadmaster_granite_peak_boys_mountain_bike_24-inch_wheels_green.pdfIn PDF document text
- https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_8e600adc8c4d489290688b601750c5c9.pdf?index=trueIn PDF document text
- http://luzeparuzibez.rf.gd/perkembangan_teknologi_sistem_informasi_akuntansi.pdfIn PDF document text
- https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_7b3fb6065b0b48728f6a54b999d2234f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3fc210ce-2da2-4afa-b495-2245565b6324/saga_harry_potter_editorial_salamandra_precio.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7cb425ef-fd9e-410b-b622-9d6f8d8014df/toxesulix.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2DE | 5268 bytes |
SHA-256: ed79092bc97daf0b0c70d348582bdf097dbf858a3f7d7e50d48077a70bc50195 |
|||
font_01_sfnt_off000104d2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104D2 | 10968 bytes |
SHA-256: cfeeba0e2c4c3f92f87db3a8c1f0277541846d16f51c99ad19b31d0cc350ddf5 |
|||
font_02_sfnt_off00012a28.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12A28 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.