MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to 'ponafet.ru' and a query parameter suggesting a lure related to a 'night owl doorbell camera'. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a large number of links on disposable hosting, further supporting a malicious intent to distribute or phish. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=night+owl+doorbell+camera+walmart PDF link annotation
- https://cdn-cms.f-static.net/uploads/4500692/normal_60121c0b19f58.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4411944/normal_6007dc472ece0.pdfIn PDF document text
- http://tejowigasinafu.getenjoyment.net/big_boss_oil-less_air_fryer_manual.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4414678/normal_5ff9efc087512.pdfIn PDF document text
- http://clubstore.info/ruzetagunavisobigajaohs9z.pdfIn PDF document text
- http://nomudepalak.medianewsonline.com/pogugapajojirenilesubonet.pdfIn PDF document text
- http://xufopizaxeto.medianewsonline.com/86855324706.pdfIn PDF document text
- http://mojofaza.mypressonline.com/danugegukavisopul.pdfIn PDF document text
- http://daravto18.ru/81345353064v29t8.pdfIn PDF document text
- http://topcreditmonitoring.info/al_bayan_arabic_font_freeuigsv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373304/normal_604af72a40f4d.pdfIn PDF document text
- http://narovomesizi.medianewsonline.com/71201947715.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_b51090c92f8a40aaaf2b272b9ecf4018.pdf?index=trueIn PDF document text
- http://nodikaduf.onlinewebshop.net/rubisuvekune.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b582c7f-b12b-45a2-b5f1-1aa7a20df24f/kebedisexunujudazefesexe.pdfIn PDF document text
- http://zisukuvi.atwebpages.com/business_environment.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd6cae02-01a0-4a24-b14d-46e43bb22904/losoreruluxiwazo.pdfIn PDF document text
- https://ebc1add8-0b9d-418e-9e4a-1e287827e933.filesusr.com/ugd/ab63e3_50365f75cb2743ae86e7264bb3fe2cb6.pdf?index=trueIn PDF document text
- https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_09f7db94c79448aa8631af94dd19eb9d.pdf?index=trueIn PDF document text
- http://pizenusogusu.atwebpages.com/38031699926.pdfIn PDF document text
- http://mavuriwowul.myartsonline.com/83073320762.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b765721d-1b38-41fd-9a19-03eaf80335c9/hp_officejet_pro_x476dw_mfp_not_printing_black.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8732fdfb-d7a7-4a56-b61a-89f5319e1fb8/vocabulary_from_classical_roots_c_answer_key_lesson_1.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9BF | 5376 bytes |
SHA-256: c1c16437ca682aca9c4237ebbad5eb4109670c958b2d1da375df29009c208bb1 |
|||
font_01_sfnt_off0000fbf7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBF7 | 11184 bytes |
SHA-256: bfa9de8a5d0cf94ecb86741c3d519567aa3952a9d0270957b0d28d7864a17879 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.