MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains an embedded URI pointing to a suspicious domain, trafffi.ru. ClamAV and an ML classifier flagged this PDF as malicious, specifically as a phishing trojan. The presence of an external URI suggests an attempt to redirect the user to a malicious site, likely for credential harvesting or further payload delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafffi.ru/strik?utm_term=lunenburg+middle+school+staff
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a4398efa-bf9e-49ca-886d-4f8df860e8a5/ligepusufamelufixujot.pdf
- https://static1.squarespace.com/static/5fc0fe2417e7202640eab110/t/5fcb36228dcc5603bef0bbf8/1607153191516/ice_cream_cake_strain_packaging.pdf
- https://static1.squarespace.com/static/5fc57497bd14ff0dd2bb5313/t/5fc9c7d5e262c01594625c0b/1607059413635/paul_hardcastle_jazzmasters_4_songs.pdf
- https://s3.amazonaws.com/selivuvumepaveb/envato_free_template_powerpoint.pdf
- https://s3.amazonaws.com/luropi/lepik.pdf
- https://s3.amazonaws.com/pazifetanegapu/24318147646.pdf
- https://static1.squarespace.com/static/5fc338c4be9b69395119d659/t/5fd0678c0c0c9b10ab0794de/1607493519326/leo_s_flight_simulator_pc.pdf
- https://static1.squarespace.com/static/5fc129dd17e7202640ebdc1b/t/5fcb5407b495bd20281fa040/1607160840031/87807991539.pdf
- https://static1.squarespace.com/static/5fc2c6032e34347c70505203/t/5fcddc3424c49707d3414e52/1607326774082/76843000057.pdf
- https://s3.amazonaws.com/metubevozisul/21420385211.pdf
- https://static1.squarespace.com/static/5fc0c87788c99b6d37a67a80/t/5fc5462dfa04221c71cd2d31/1606764078226/23974871321.pdf
- https://s3.amazonaws.com/gewuwasi/morimabojinawuk.pdf
- https://static1.squarespace.com/static/5fc0f05df9866f3fd2d48fd4/t/5fc52df718e72e5fdb7ef895/1606757880970/introduction_to_poetry_analysis.pdf
- https://static1.squarespace.com/static/5fc0f769ec917750a3d83c85/t/5fc2514c3570fb44d14e4d22/1606570316390/photoshop_cs4_key_generator.pdf
- https://uploads.strikinglycdn.com/files/2cebca35-73d8-425e-bbab-22b2517f973f/sekejutow.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cfbe.bin69e1dcf85e383397feb98d7719e71c538ffcb187d99cebb38bd70c82958a1902 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCFBE | 5516 bytes |
font_01_sfnt_off0000e253.binbf28aa4c2e2e18e406fd738f095137511b20d144d82ac83d16a305f6119aab6c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE253 | 10028 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.