MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one pointing to 'ponafet.ru', which is flagged as suspicious. The document body, though heavily obfuscated, suggests a lure related to maps, likely to entice users to click on the embedded links. The presence of external URIs and link farm heuristics further supports a malicious intent to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9986
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=mapa+de+pueblos+de+puerto+rico+en+blanco PDF link annotation
- http://repaircreditscore.info/links_awakening_turtle_rock_keyaqc34.pdfIn PDF document text
- http://xufelaketodo.getenjoyment.net/bedolasovodatevilonite.pdfIn PDF document text
- http://ritual-venki.online/mengubah_word_ke_2007taca3.pdfIn PDF document text
- https://xotukowigadane.weebly.com/uploads/1/3/4/6/134683058/tiderem-kedofurojilu-mevogewafirun.pdfIn PDF document text
- http://gedozudusinap.mygamesonline.org/89821099218.pdfIn PDF document text
- https://gisevivejomu.weebly.com/uploads/1/3/5/3/135393920/2a063afeac6d21a.pdfIn PDF document text
- http://svoylend.xyz/562886110141q9qz.pdfIn PDF document text
- http://freshmind.net/tuxolorizetanc7cq4.pdfIn PDF document text
- http://dipugipedanam.sportsontheweb.net/oss_bss_in_telecom.pdfIn PDF document text
- https://mubujibazakob.weebly.com/uploads/1/3/3/9/133986275/julapa_xojak_kelubotizujemif_xuzotesobegenar.pdfIn PDF document text
- http://legendnat.space/what_household_product_kills_ringworms3rbw.pdfIn PDF document text
- http://vinnipoh.space/american_society_for_quality_six_sigma_green_beltd3jr9.pdfIn PDF document text
- http://nesobaka3.xyz/59238306439ma0rx.pdfIn PDF document text
- http://cancandance.org/what_do_you_capitalize_in_a_subject_lineyxsbm.pdfIn PDF document text
- http://storeyou.store/steel_ball_run_race_real_life0e1iq.pdfIn PDF document text
- http://autobaff.xyz/zunefabutokurifxu0c.pdfIn PDF document text
- https://lujukote.weebly.com/uploads/1/3/2/7/132712447/tazarave-zawuwaximir.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a067d059-c73c-432f-9ab9-c07fdd2cbb9d/bruce_lee_death_reason_in_marathi.pdfIn PDF document text
- https://156bb51f-0b62-477f-88ca-8620af00812b.filesusr.com/ugd/e3ff21_10585ecdf6b54105bb5d26629985bc7c.pdf?index=trueIn PDF document text
- https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_275f6b9707a842ebb0bfad0d2d0d5477.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1eb77fd8-4184-4c9d-91cb-cfdd6ace5393/bidiwe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce9395be-a805-4994-b1ee-5b3423e4e91b/40843126233.pdfIn PDF document text
- https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_3b0d59649a7a4101a810109db4a68cf2.pdf?index=trueIn PDF document text
- https://05790d5e-93e9-4545-bcc4-99c37f081c18.filesusr.com/ugd/bff4d5_b4b2b3ffb8f04297994c548830f7adb9.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001bcac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BCAC | 5212 bytes |
SHA-256: 5f04122347edabc4360ac7db1c3a4ecd60cd1c911fbfae446686872d3825000d |
|||
font_01_sfnt_off0001ce78.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1CE78 | 10760 bytes |
SHA-256: 79ee7d3169bc569c8041c29900cfc3d1e09a6f1ba778a8dda3ea5279e691fe1f |
|||
font_02_sfnt_off0001f334.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1F334 | 16204 bytes |
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.