MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample was detected as a phishing trojan by ClamAV and ML classifiers. It contains a large number of external links, suggesting it is part of a link farm or SEO manipulation scheme. One of the embedded URLs, https://ponafet.ru/wix?keyword=carlos+chicken+parm, is likely a lure to a malicious site or further malicious content. No scripts were extracted, limiting the analysis of direct execution capabilities.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=carlos+chicken+parm
- https://cdn.sqhk.co/mozopojugode/d8gdgeV/lep_s_world_2.pdf
- https://cdn.sqhk.co/redupalulaxo/zmgcij9/96860441005.pdf
- https://cdn-cms.f-static.net/uploads/4380854/normal_5fd9f60a98b90.pdf
- https://cdn.sqhk.co/fewibefanid/hghfM8g/rivimefezolovej.pdf
- https://cdn-cms.f-static.net/uploads/4471273/normal_600f32b65279c.pdf
- https://cdn-cms.f-static.net/uploads/4478669/normal_6046673bcf384.pdf
- https://sobexezawatu.weebly.com/uploads/1/3/4/9/134903145/fizunikobodax.pdf
- https://cdn.sqhk.co/zubejavaxuvu/hghjnha/call_of_mini_battlefield_hack.pdf
- https://cdn.sqhk.co/tonuviwa/GWyzQhe/transformers_bumblebee_gif.pdf
- https://static.s123-cdn-static.com/uploads/4443810/normal_600388698b1f4.pdf
- https://fekifefexil.weebly.com/uploads/1/3/0/8/130815726/voragawasig.pdf
- https://cdn-cms.f-static.net/uploads/4379859/normal_60171ba57af5a.pdf
- https://jaxuvoxet.weebly.com/uploads/1/3/5/9/135979876/kisafakor-megamuvazosapej-negofenozimim-taruw.pdf
- https://talaxosukizarom.weebly.com/uploads/1/3/0/7/130775084/kakewelubu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/6bbbfb27-8772-45db-9bb4-cecad4790c2d/melozafalubomite.pdf
- https://uploads.strikinglycdn.com/files/5b118303-c5ed-478f-9527-ef7a823e71e9/nordictrack_cx_925_parts.pdf
- https://uploads.strikinglycdn.com/files/9cce3161-91a8-4d40-a3e9-d8ca36228cdc/toxexavunijewimosajurew.pdf
- https://uploads.strikinglycdn.com/files/1367d6f0-1a06-47ac-823c-060a1e572d7a/chronicle_of_a_death_foretold_chapter_4_quiz.pdf
- https://uploads.strikinglycdn.com/files/210c389e-5453-4a2f-8035-247d1a6be1a6/how_to_connect_schlage_lock.pdf
- https://uploads.strikinglycdn.com/files/92410185-ccdd-47fd-b8a0-b36d95d4dbdb/tolowufakuvidos.pdf
- https://uploads.strikinglycdn.com/files/c09dc169-643b-46f6-9ad2-212e399320cd/fundamentals_of_pathology_pathoma_amazon.pdf
- https://uploads.strikinglycdn.com/files/f9d1610c-7852-4b9d-a55c-4bb28610aa9a/mathematics_textbook_grade_8_free_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef34.bin53a6b61d01ea5ba68dbfa8d7397e38a837e19218ebe4118cc0c26abd877b01fe |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF34 | 5144 bytes |
font_01_sfnt_off00010083.bin0f5476c437f03eb5331ecab84bb37ac090080d51fca2bc98eb465792c26a43db |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10083 | 10844 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.