MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded URLs, one of which, 'https://ponafet.ru/strik?utm_term=how+to+get+free+money+gta+online+xbox+one', is associated with a lure for free in-game currency. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is part of a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=how+to+get+free+money+gta+online+xbox+one PDF link annotation
- http://kiluniv.22web.org/ja_passou_antonia_gomes.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375886/normal_6034c0683183f.pdfIn PDF document text
- http://tehnikator.ru/60297131962t3q4x.pdfIn PDF document text
- http://kukushka.space/pejadomafeluxiselubksy0.pdfIn PDF document text
- http://beach-fruit.fun/57905720342gbq5r.pdfIn PDF document text
- http://apsmall.space/the_illustrated_man_prologuei3vgu.pdfIn PDF document text
- http://chambrehq.xyz/10656926893ev3ir.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479933/normal_5ffa35103e530.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459937/normal_60655b23670bc.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://kelawezup.rf.gd/mizujizukinilukupawudeded.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4d9b3dd-a554-4df4-bc62-386b64b30a1e/how_do_you_use_critical_thinking_in_everyday_life.pdfIn PDF document text
- https://s3.amazonaws.com/xidulumexi/topofigiruvozufoz.pdfIn PDF document text
- https://s3.amazonaws.com/figugipopar/31449098313.pdfIn PDF document text
- http://pokogasojogev.epizy.com/fabag.pdfIn PDF document text
- http://lomurobutu.epizy.com/atresia_esofagica_clasificacion.pdfIn PDF document text
- https://ba3a7bb5-edd2-4228-b29c-cf272df6a868.filesusr.com/ugd/bd1c09_6a0add6ce03d4016beeda1ecac448d4e.pdf?index=trueIn PDF document text
- https://011f98f8-b45f-4578-a2fd-466b530f7845.filesusr.com/ugd/74e905_ea193d2a66d74ab48364e772f95273f0.pdf?index=trueIn PDF document text
- https://2f2ab42d-e0b4-4bd3-aa50-2430da1ff5fc.filesusr.com/ugd/eaf48f_344aa60068bf47f284eae2bed023bbbf.pdf?index=trueIn PDF document text
- https://0efdb04f-128a-4c0d-ace4-8b312723ebcc.filesusr.com/ugd/5508f4_c0079dae553d4aad9600d92cd5248440.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bisute/37332389363.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f7ebc75b-61de-48be-b87f-34dc6b2c9eee/what_type_of_charger_does_a_kindle_take.pdfIn PDF document text
- https://s3.amazonaws.com/zusevamasor/android_toolbar_not_visible.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d56bec3-aee8-4334-b123-f5172e1c207a/will_stretching_increase_flexibility.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a1375bd-2e77-4868-8a25-f704555d05cc/active_passive_voice_rules_chart_in_english.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f040.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF040 | 5272 bytes |
SHA-256: 26758317a92482460c94b5a98050ed6781a1d1dfacaf4fc0e312951dd8b879e9 |
|||
font_01_sfnt_off0001023b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1023B | 11324 bytes |
SHA-256: f75dffc3dfcad9f369051c0acff7defae91ac05721949d2305a598a88a7d45df |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.