MALICIOUS
272
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains an embedded script and a critical heuristic firing for a malicious redirector link. The embedded script likely serves to execute malicious actions or redirect the user. The primary malicious IOC is the URL pointing to known malicious infrastructure, which is designed to lead the user to a phishing or malware distribution site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9507
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOADPDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/aws?utm_term=context+clues+worksheets+multiple+choice+high+school In PDF document text
- https://cdn.sqhk.co/sivunukiwe/gjVZ2Rx/today_s_nfl_schedule_on_tv.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387046/normal_5fde7b6cc14ed.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375541/normal_5f8c377372f5e.pdfIn PDF document text
- https://cdn.sqhk.co/mawedabe/vyrjfgf/dokedexolibo.pdfIn PDF document text
- https://cdn.sqhk.co/taxeseta/d67sgcc/yellowstone_season_1_episode_8_trailer.pdfIn PDF document text
- https://cdn.sqhk.co/zenetofuma/eGjgOhc/vutajazusoranam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a3cc46c-4b08-4757-925b-3f7ffb5466c8/rokowukonu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a369039b-3791-4e54-a271-5db67c84db62/sotobolupevu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a96a74e-2c37-445f-8091-b995b4f5ce79/mad_zombie_sniper_gun_shot_3d_print.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/916498c8-d0ed-4e0a-92bf-c8a9b16afcbb/wudasizivosizimimurelatuk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/204ea7e3-7563-44e9-be86-348195966be7/unbroken_book_online_free_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a31bf7cd-1bed-4e6a-9865-ab0aff9b28d1/craig_bluetooth_speaker_dollar_general.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf5be769-e6f6-49c6-aa84-b4ab9a48f8d2/zidawametos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/508a7618-3e14-43f4-bd2d-750ab9360176/super_smash_bros_unblocked_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8929760d-a64d-4eb6-94a9-a149e366951e/windows_test_port_connection_powershell.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64b07de3-0213-4668-9ef5-367588cfbf1c/12161687644.pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_pdf_script_00009e4f.bin |
pdf-embedded-script | PDF decompressed stream script payload at offset 0x9E4F | 59995 bytes |
SHA-256: 36abf020b7bcdaf6a438445e4b37b49983091b6cab35d86e6a51ebc1eba8188d |
|||
|
Detection
ClamAV:
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload:
likely
Carved artifact contains 1 shell/COM execution token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.4
1 0 obj
<<
/Title (�� C o n t e x t c l u e s w o r k s h e e t s m u l t i p l e c h o i c e h i g h s c h o o l)
/Creator (�� w k h t m l t o p d f 0 . 1 2 . 5)
/Producer (�� Q t 4 . 8 . 7)
/CreationDate (D:20210102113250+02'00')
>>
endobj
3 0 obj
<<
/Type /ExtGState
/SA true
/SM 0.02
/ca 1.0
/CA 1.0
/AIS false
/SMask /None>>
endobj
4 0 obj
[/Pattern /DeviceRGB]
endobj
6 0 obj
<<
/Type /XObject
/Subtype /Image
/Width 625
/Height 155
/BitsPerComponent 8
/ColorSpace /DeviceRGB
/Length 7 0 R
/Filter /DCTDecode
>>
stream
���� JFIF K K �� C
�� C �� � q " ��
�� � } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�� � w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ? ���m�!����m��H�L^c,p*�P B=3��Z�� ��O�KY�� O)�?�v?��K�vq7�}1��o4�
�G��v�� Z�C"� �����9����b얏s���߆. +��UL)Sq! �P �zP� �7 @t�$�h7 �[� ���+�c�r�ڮ� I=� ;��ia$@�! H!��O��w�v��[�E��� _�sR| ��ơt���[ːq��g����
o�P a��3��"y�I��
�+�dq�� ��H9 �>ߧj|Q � +�t � ��}�{ ����: �| �ז �s & ��� � ��ҟ'�? N { �YI�]����~��T�� 1�� �� �zI *FW�<o8�ӏ��j%$���� �[� ��m�Nvl���K� 3��u��� � �n�ۇ� }(��|���>����e Ԧ~R xϦ �>���1FXr n@;� x� V �kN���sc� ���c�� � =��s��ӏ�ZS����˶�iA���\ � �� �] c�%\(�H� \w������"� �g vK ��j,��%��'�� $ۆ������$v�.����
ص�m�r'� z�� �WO ,q ��������� #�r � _j v���s���'��X�X �@��e#=z���� �a1,zrd6B���3�~�x�� �g5љ]'P 9b '�\ O s����� 7d����Q�}}� Zv�ϟ�qM�� � ��:� <; |�x98�b3� }�4����H�:q߀ �N:�Hn Wt�v�X � �לt�E �ʁ�.=��JE��9���@�F�ȣ* �% }�� ��s��#| ��l�� �����q��Q��]0 ̤��� ���� Z�c ln �m . ��з ~��9x~ �w���)�� �O��rAbG�O� �A��`�`+� 3K��`O_�t� c�r� q� �#9� ���� v�"�1��� �p �"��1,�� ���A��H� xz" -5C( by <�p��:q],F9Y�ۊ1� ��8�GP���� 0{���+t)KNe/����/ �� E ��� �0'��;un���� �=q<���*� ~�A��� ����Tw8�1� �^����S �� �� A o�3��N��d��� ���3 �� �!��� ����� ��}�J� �:ُ�9Yx'7 �� n� ��H#-�'Bs� \SS%�a�X� �r?�j[�To w��sQ�%��8 h�:���1� ��� �?�,� �8 ��P��"yx�s���� �1� G��O ԝH� (� � �� cZ� ��� Z��? �<�z�� G�V� н:�/�� ��UW
��S�;}�J�P �/� � z$R� �ߚ/�(���� ; �| ��a�`�` ��r9���8�� Jj|'��!�M ��C��S��:u��Wd�>�3� � ��{�L��Yw >Q� �'���SD6���9��S~ ��� a� �H@��>osQ �ؑ�i� |��h������S�ϧT � mR>�8�� 9��I��P[p�` � } J.��6> �rH� h ����� ����Eᵜ Ә�����^s����� �I�$ *�I� c����~nN� \�>�'��� �����sG��� >m;p e������i��è�n��� ?} # ��_�𮐹/� d�=� �� `��.�� �:v� =iX�{j����s�A�4��>|�#� 1��<�S��φ� �y �l��Oqر��q���LІ*v�rr %O?��z�2 d 0 p���u��� � ������|�y� h% ٍ��&\ `��ޣ� � �� V`4ё�ظ� ��>���l>A _� ~�p"�9 q�G '�:s� ƒ�\�o������ ��w��ϐ {� ʐ|#��% ��m#-q) �#�w �c��#%w� �v8�=E �b6�* 9 A�� <�n�m�x� _���� �^ �t��l ��x� ^�=:}i���y ���#��Jr �� ?�t1���ʼn� bI ����؍��� 9 q�� ǹ�bUF����� �8���x!FH72|� � j| �9 �i���ϗ��� ��D� � �v� $��i��H�ې�;� � �� ?�V�~�һ� ����t�&��Ďl6� � �� s�������m��ì#Μ���>�.:����zz���&�
2�6��x����服� ��00��u8��sMh&ܝ��� ��sg��_M�� �y?_��� t �)Ұ �L�c � ����q�C� � � _aHʩ W � ���?O�!ɶ�9��S� L � 帔c���J �/ Ƭͧ�B s<�7�-�k�H� � 3t { �� Zs�f�Fp ��z�hЯz�Z _��s1|#��`
1Wp���N������N�� ��1��m u �e������k�H ޛ ?1\ �O�Iшf�E� �Q�>��?:,��4�9���í Ι�I� ��� j� � In�^�ؐ H������Mt�2��PŎrGC�O� Wa�K+;I�`��� #$~�i�NMj��� _�s�� �Ҡh�ݠ��<� ���_�D� �;>P��`��ne�c8�� ��#�,���ߑ��� Z cwc#�T��d w � _���+���i�}�2~ �jU1 g 9 iW�t 7�� ��w�j�1�m� m�Q��w��ں@�^�
w7$g� ��?�4� �q ��qԌcځE� �9s��@��4ؕ~�EĀ��|��1�*H� xmdg � �'�������{WD�p,��$��?��� �$R�c�_�d N ��� "�Z ٦��8� �8cd:r�NߞY} �z �M���n&%�� �ǟ) < 7c���+����HP�� )�Oקa� �:*�� m��8� '����B������� v?�~ V �-�_�"�C�1��� ���| ��(WO;rA�s(�^k��?3�, ��x��} G��'
� s6�B��O��4$9I� ����9����;� ; ���"R3�?{� Z�7�� �9Ӏ ���s�� �� Z�I�a^�N s/ ��NI�����
� ���b��?�����/��
@�n�Xĸl�!<t9ݒx� '� �� ��S�1YO,~�!�����q�q]3ǂ0[ W���\p>���ɀ��9 c�ߞ�� bJ�?�O��g6~ xr ʮ�����C�� �x� �� i�4�г ���� NO�� �
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.