MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains embedded URLs and is flagged by multiple heuristics, including a machine learning classifier and ClamAV, as malicious. The document body, though heavily obfuscated, suggests a technical topic, likely a lure to disguise the malicious intent. The primary malicious URL identified is trafffe.ru.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafffe.ru/aws?utm_term=pulse+pressure+waveform+analysis PDF link annotation
- https://cdn-cms.f-static.net/uploads/4375514/normal_5fa35e36932b7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tikofaketonub/90980429545.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/025ab43d-c662-432d-b851-8ece28468036/franco_sarto_purse_prices.pdfIn PDF document text
- https://s3.amazonaws.com/xidulumexi/wells_vehicle_electronics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/05d4db56-777c-4f99-8b4b-6a2d4bc74c4b/kifunutezagesitibex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64aafe80-1b7f-4b56-9d9d-bb5485975f33/81154237869.pdfIn PDF document text
- https://s3.amazonaws.com/bifadiwuwileji/scooter_3d_model_obj_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45b4b88d-b9a6-4389-b301-b7d5d925db70/48665744991.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5df4bb52-fd33-4643-90ef-be82476e16e5/vomexede.pdfIn PDF document text
- https://s3.amazonaws.com/bejexe/latazukigawar.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6a933f75b16643cd8d6d/1606380180192/babejopavujir.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36fcfd7d-4cf7-414e-82c2-432f7f6d9f5f/41188279413.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e3ae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3AE | 5304 bytes |
SHA-256: a6f570aacda35223929cdb920412677e4e00300826bdb93cd3bffa5704905394 |
|||
font_01_sfnt_off0000f5c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5C1 | 10248 bytes |
SHA-256: 1bb03ce31080b5e3f51a81ffa133ae4dcb03b72c99ea2d76fcde7710864e6753 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.