MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URI pointing to 'ponafet.ru', which is flagged as a phishing lure. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, suggests a lure related to a 'Dr. Seuss happy birthday book PDF', likely intended to trick the user into clicking the malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=dr+seuss+happy+birthday+book+pdf
- https://cdn-cms.f-static.net/uploads/4384039/normal_6017828e793d5.pdf
- http://banquepopulaire-fr.org/free_avast_antivirus_1_year_validitydb445.pdf
- http://maturibcgj.space/tapolutilunisewilumeducroxa.pdf
- http://muzhskoizhurnal.ru/baby_shower_invitations_templates_editable_in_gujarati3k5ny.pdf
- https://static.s123-cdn-static.com/uploads/4424981/normal_5ff8b396a60d5.pdf
- http://onlineeshop24.xyz/levis_jeans_uk_size_guide52pw6.pdf
- http://autokenn.com/88001252841uokj5.pdf
- https://cdn-cms.f-static.net/uploads/4464082/normal_600d5d0539d5d.pdf
- https://cdn-cms.f-static.net/uploads/4370092/normal_5fd6eee581b05.pdf
- https://static.s123-cdn-static.com/uploads/4426090/normal_600191323625a.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_3d974dc0459c40efa26403556be66d0a.pdf?index=true
- https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_8ffaf1ef60ee4b93b21796006f2568fd.pdf?index=true
- https://uploads.strikinglycdn.com/files/9a2c8383-b950-4530-bd0e-1e9df7c57015/simple_english_wikipedia_word_list.pdf
- https://uploads.strikinglycdn.com/files/db9f0010-46d6-4f5e-80a8-99e4b8df121a/45526641848.pdf
- https://uploads.strikinglycdn.com/files/309373a0-a7a8-4ab3-8cad-96586c8b7400/47388092207.pdf
- https://s3.amazonaws.com/tipikaxe/24915097676.pdf
- https://s3.amazonaws.com/popilo/smc_flex_manual_espaol.pdf
- https://s3.amazonaws.com/fatikonavori/pandora_music_apk_android.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb04.bin222e241b56350635c0f9ab61c24d29ea1a25f60f4066938338a78c79fe3aaeb8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB04 | 5404 bytes |
font_01_sfnt_off00010d67.bin13c2d0005d9390fb4cc7222a1e1367b971a7813f93b79595598782662a4a07c8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D67 | 12124 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.