MALICIOUS
136
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a PDF_SEO_UTM_REDIRECTOR_LINK heuristic suggests the document uses an image lure to redirect users to a phishing or malware download site via the URL https://traffset.ru/123?utm_term=black+flag+fogger+solution. No scripts were extracted, but the overall structure and heuristics point to a phishing or downloader attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffset.ru/123?utm_term=black+flag+fogger+solution PDF link annotation
- https://static.s123-cdn-static.com/uploads/4476582/normal_5fc5db898b1b4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379849/normal_5fd635ce40e10.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369920/normal_5f96e2fc2ed17.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446643/normal_5fab26dd30f5c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6914aa34-0f1a-407a-beb6-8ea7e5ff371c/stargate_sg1_fanfiction_sam_and_janet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/037ecd69-3669-4fc1-acdd-0ba131a77e9f/final_fantasy_x_x2_hd_remaster_bradygames.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/39f5d81c-62e9-4b33-9d47-c1b22625cd60/rumunezuvexaruxememep.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/135dbf94-bf79-4c00-b75d-7b73cc99d297/77271593569.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0109b0b6-4e16-463c-b11d-ad81ff1b3f52/borderlands_the_pre_sequel_grinder_recipes_steam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/138575d0-4a04-4c93-bd10-220577dca918/29057523130.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd6763b5-9d03-4f47-a438-99a8c55e8834/billie_eilish_i_love_you_lyrics_chords.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f665305-9500-4017-8cb7-b5ba98ddda09/carlson_guide_to_landscape_painting.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e645306f-8a17-4717-a9ad-3f3777979341/vasivawimuvejim.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1f1b9b4-e0fa-472d-9fe4-b0d1da4285a8/sesedifinedesitep.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa570727-9313-4d1f-8b08-e24a93cbe7a0/wodokarokugerojovaxu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fef8894e-afa2-4c7a-a30b-960586cf6026/flexispy_apk_download_for_android.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7862298f-2580-497d-b075-212d18e365b7/viwisebemalak.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/56f23512-a35c-4e87-935f-d39773f32619/alliterative_sentences_worksheet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b592.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB592 | 5164 bytes |
SHA-256: 33c80931bf7e8086d36db4ea008a1982fe212c91ac5d91baee4f1d968cd1617a |
|||
font_01_sfnt_off0000c73b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC73B | 9784 bytes |
SHA-256: 72c8738b72d778d122fb2532f69a46539213c77a21413d249a2818371b234c6d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.