MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'ponafet.ru', which is flagged as a link farm on disposable hosting, suggesting a phishing or redirection attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=eleanor+%2526+park+age+rating PDF link annotation
- https://static.s123-cdn-static.com/uploads/4446045/normal_5fdee518e9252.pdfIn PDF document text
- http://vurejowug.mypressonline.com/16455160148.pdfIn PDF document text
- http://kevilokosolug.iblogger.org/advanced_english_speaking_course_free.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4423431/normal_5fd09bd1b8a35.pdfIn PDF document text
- http://sobofikikovir.22web.org/have_yourself_a_merry_little_christmas_karaoke_michael_buble.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4445881/normal_5fc86f9a231f1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443814/normal_6040023392f1d.pdfIn PDF document text
- http://bukejasinopa.22web.org/new_year_s_day_tv_guide_2018.pdfIn PDF document text
- http://rirenanevigi.22web.org/how_to_do_guided_reading_in_kindergarten.pdfIn PDF document text
- http://marifivelaj.mygamesonline.org/2944249256.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f9194291-e52a-4aba-88e7-462169f57ea4/organizational_structure_chart_of_walmart.pdfIn PDF document text
- http://fopijokukipi.rf.gd/netovovadimabawo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd2369f1-7f94-4160-adf3-a9eef7fac516/25078563778.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cc37c393-c565-4f44-b8d4-5d56dfbf29d8/kin_latin_root.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9706d85c-9df2-475a-aa40-1375b396047c/how_to_help_auditory_processing_disorder.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f5f08b2-acfd-4890-97d3-cf309290a34f/run_on_sentence_worksheet_third_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0cdc8b0-61b6-4093-9530-4d3d708ec1cd/sanokabogiko.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aabc44cf-a43b-4e58-9975-7a5dfa4e2c74/zirata.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1375d9c-3e06-4c49-b77d-0fafec399e76/zuzesiluwavavodiledab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ad563c5-4cfa-4bba-ae18-6af6a6805745/4412710704.pdfIn PDF document text
- http://zitasixan.atwebpages.com/maytag_front_load_washer_and_dryer_prices.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76163228-f5ea-4264-b6f2-3c6e3f6d2919/can_you_flat_tow_a_2020_ford_ranger_4x4.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31e687ed-0d97-402a-8e06-2d6f94560a2a/xojelexexusa.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f6cf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6CF | 4452 bytes |
SHA-256: 76ebfcd9f71cd90a2d24acc99920e9e26424f7db7a7b05febd481f0a136e41a1 |
|||
font_01_sfnt_off000105f3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105F3 | 11324 bytes |
SHA-256: eb48256ca70046a1143ca033c2c4ff03cb4e04bc5719714802d0450ffead54e2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.