MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many of which are to PDF files with numeric or long-tail slugs, indicative of a link farm or SEO manipulation. One of the primary external links, 'https://ponafet.ru/strik?utm_term=how+to+fix+car+heater+blowing+cold+air', suggests a lure to a potentially malicious or phishing site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=how+to+fix+car+heater+blowing+cold+air PDF link annotation
- https://vifiboreb.weebly.com/uploads/1/3/5/3/135349596/9723918.pdfIn PDF document text
- https://siraxaroxaran.weebly.com/uploads/1/3/1/4/131483069/nemovizux-bomaguvinebok.pdfIn PDF document text
- https://cdn.sqhk.co/vagofedewat/idmuie1/furosulolawup.pdfIn PDF document text
- https://cdn.sqhk.co/jaguwubax/jg5jfib/momavogusebofimovamen.pdfIn PDF document text
- https://cdn.sqhk.co/vuxeneson/Ajeicia/77666884086.pdfIn PDF document text
- https://dawokopo.weebly.com/uploads/1/3/5/3/135314789/f0e7dbd3c23.pdfIn PDF document text
- https://cdn.sqhk.co/xolizoxime/je5Bhbd/dezux.pdfIn PDF document text
- https://cdn.sqhk.co/rabataxuvax/JDhcibj/32924755588.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7691ef74-6bac-4845-bedd-6a0031db1fa5/naming_ionic_and_molecular_compounds_worksheet_with_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5d4d20bf-2028-4232-a3e1-cacbd437a17c/88517871975.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/915e24dd-5b5a-48c1-97c4-2eb9fd791bb9/faduluxinuroroxasa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/14ac4eb5-8103-4606-a201-ea0bd6a4d83b/63439646443.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85753821-af87-4e05-8d1a-e6fb664efbb2/physiology_books_name.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ba38be4-47da-4d7c-be4f-fcb93913f673/38870825674.pdfIn PDF document text
- https://s3.amazonaws.com/jajoxulabojaso/waterpik_water_flosser_cordless.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a8cb4e07-b917-4b08-908b-dc690a1cfb56/empresa_y_organizacion.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c49791e0-fdcc-44bb-ba1d-6e59160e6026/sejanine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e57cd74-1571-45aa-8ba3-f45909ed42d3/kesunujis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04180513-973d-48be-8333-3eef8ad4a890/how_to_disengage_hydrostatic_transmission_john_deere_zero_turn.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6aad016a-47bf-4813-a96a-3c3382b8eca4/110_dirt_bikes_for_sale_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f9f3b60-ad7f-47aa-802b-92df0fa100ee/abu_garcia_ice_max_reel_review.pdfIn PDF document text
- https://s3.amazonaws.com/wekibik/48_laws_of_power_on_silence.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00016b8e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16B8E | 5364 bytes |
SHA-256: b3f83881f252c73e8d399672f21d09341c81f595405fe4d6479fe9082c4732d1 |
|||
font_01_sfnt_off00017de1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17DE1 | 11436 bytes |
SHA-256: 1505c899698838790dbf351ceb4d562a34459fc1e6dffb691dba9ee69f6f6402 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.