MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of an embedded URI pointing to 'ponafet.ru' suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are strong indicators of a malicious document, likely delivered via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=meaty%2527s+subaru+timing+belt+guide%25E2%2580%258F
- http://jushq.club/desenabezesirokorupeb0pjyd.pdf
- http://raifaisentgo.online/dinolon3365.pdf
- https://static.s123-cdn-static.com/uploads/4465136/normal_5fce27a6d650d.pdf
- http://hr-insider.com/42017277291gxlog.pdf
- http://vvinorama.website/lagu_beautiful_in_white_versi_karaokeutshk.pdf
- http://dihtyar.online/how_to_service_a_toro_snowblower9rmq2.pdf
- https://cdn-cms.f-static.net/uploads/4378619/normal_604e67bd3c4b1.pdf
- http://pinezotamex.getenjoyment.net/32155283062.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/3cd99da6-32be-4e08-9ea1-df9f8edf028c/unidad_5_modelos_de_pronosticos_e_inventarios_investigacion_de_operaciones.pdf
- https://uploads.strikinglycdn.com/files/aefed114-f3c6-429a-bf95-de438d6661a9/gepafulos.pdf
- https://uploads.strikinglycdn.com/files/e02878d0-27ff-4049-ad72-a62d46000931/the_game_of_life_board_game_instructions_uk.pdf
- https://s3.amazonaws.com/nevovumowa/how_to_refill_epson_18_ink_cartridges.pdf
- https://s3.amazonaws.com/julaxel/minecraft_bsl_shaders_1._12._2.pdf
- https://uploads.strikinglycdn.com/files/24e7ce8d-30d4-4f26-8a11-aa22012a4a6c/what_does_an_ab_60_license_look_like.pdf
- https://s3.amazonaws.com/firudegix/kazagelaburuvuzu.pdf
- http://gevotuwelu.rf.gd/98705626873.pdf
- https://s3.amazonaws.com/zonivezada/cisco_asa_5508_datasheet.pdf
- http://pojezevosolodo.rf.gd/welil.pdf
- https://uploads.strikinglycdn.com/files/1f0622af-0b71-4020-945a-c8a4e7a39b4b/47257357194.pdf
- http://voturugivorajop.onlinewebshop.net/61657260285.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000103c2.binac0a1510ae4bd3f4e85e0693669153618b48261129687e69d9fb012c78546777 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103C2 | 5428 bytes |
font_01_sfnt_off00011639.bin555016c8c2e41350aee4a9f4f8cba6095df06672adaae6aa1cd2cc94a184b09a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11639 | 10768 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.