MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document flagged by ML classifiers and ClamAV as malicious, specifically identified as a phishing trojan. It contains an external URI pointing to 'ponafet.ru' which is likely part of the phishing lure. The presence of a 'download button' heuristic further supports the phishing attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/award?keyword=bwv+565+guitar+pdf
- https://cdn-cms.f-static.net/uploads/4405193/normal_60342117ce519.pdf
- https://cdn.sqhk.co/penuvipaw/hdilzhc/puwolafowivemoboribijiju.pdf
- https://cdn.sqhk.co/tukawezezo/gidaRgj/24151461218.pdf
- https://cdn.sqhk.co/senuziker/jdQhhBn/monster_battles_tcg_hack.pdf
- https://cdn-cms.f-static.net/uploads/4473062/normal_60414fb8be1aa.pdf
- https://cdn-cms.f-static.net/uploads/4407064/normal_600fcabc71126.pdf
- http://famekeletiti.iblogger.org/merge_mac_os.pdf
- https://cdn-cms.f-static.net/uploads/4415326/normal_6023a828ea60b.pdf
- https://cdn.sqhk.co/valujoper/uFJIjha/maxpreps_utah_basketball.pdf
- https://cdn.sqhk.co/suvotoruwot/1Qiihhi/best_ultimate_vpn_download.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://jopiwutipav.epizy.com/mental_math_multiplication_worksheets_grade_7.pdf
- https://s3.amazonaws.com/ronenitevodo/gozinoxilexarawabisowatu.pdf
- https://uploads.strikinglycdn.com/files/3a45c80b-b14e-41d6-81de-d6cc62d434a3/lalisezuw.pdf
- https://uploads.strikinglycdn.com/files/194f30b3-a1e6-4ebb-bd80-b2443b273477/caterpillar_416b_backhoe_service_manual.pdf
- http://daduzafez.epizy.com/68985216757.pdf
- https://s3.amazonaws.com/jukezeluf/34865830820.pdf
- https://uploads.strikinglycdn.com/files/47a0c95f-eff9-4a57-8f29-b445c4ed9e94/bobimebe.pdf
- http://dojiseb.epizy.com/bose_s1_pro_specs.pdf
- https://s3.amazonaws.com/kikunojulejuj/95202585927.pdf
- http://kodibonu.rf.gd/best_emulator_for_android_ps2.pdf
- https://uploads.strikinglycdn.com/files/e1c44b9c-e515-4867-8629-59d481c9529f/dnd_5e_classes_ranked_2020.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000104c3.bin51689775c0a42bd4c28263d9976ccec16314403ec2dc5dc661729036c3dcd203 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104C3 | 5480 bytes |
font_01_sfnt_off0001179c.binb60738a18a8e0ab1108a16bca9b4541a4b5cd68863c5cb1b8302ab14e181cf79 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1179C | 11972 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.