MALICIOUS
254
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple critical heuristics as a malicious redirector and SEO link farm, indicating an attempt to direct users to harmful sites. The embedded URLs, particularly 'https://cctraff.ru/123?utm_term=the+past+is+a+foreign+country+meaning', are identified as malicious redirectors. The ML classifier and ClamAV detection further support its malicious nature, suggesting a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/123?utm_term=the+past+is+a+foreign+country+meaning In PDF document text
- https://komolelavox.weebly.com/uploads/1/3/4/5/134518501/4169842.pdfIn PDF document text
- https://lozulijulejibog.weebly.com/uploads/1/3/1/8/131857057/pakumuxonutili.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/mamukawaxatali/67175115244.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0fe386b97992eb55c938e/t/5fc3e1dfeaf37e3b64138878/1606672867035/62005447762.pdfIn PDF document text
- https://s3.amazonaws.com/joterige/dumbbell_chest_fly_form.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0c362403f5353fd950a5e/t/5fc3c2a47acac6192a333377/1606664868795/60957661504.pdfIn PDF document text
- https://s3.amazonaws.com/warapagefasovi/powerpoint_roadmap_timeline_template_free.pdfIn PDF document text
- https://static1.squarespace.com/static/5fdc9ff03a83d042422c3343/t/5fdce00ce6fc5f5a9160f057/1608310797297/anganwadi_online_form_kaise_bhare.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc68be9405d5340f350cd4c/t/5fcdab46e43f2b00a8c5f45d/1607314246675/smart_launcher_5_apk_mirror.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc106a17848ba205d193829/t/5fc1764df81c9a2a0cd9413b/1606514254162/zinunaze.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc51b403398ff7515490ab2/t/5fc774a81d106d256bc3cc41/1606907049319/heron_circle_spartanburg_south_carolina.pdfIn PDF document text
- https://static1.squarespace.com/static/5fcdfcfaecb86110b1356bd8/t/5fd6560e154d727871e9b4db/1607882255282/using_update_statement_in_sqlite_in_android.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc28fbed26ff1194f7e5808/t/5fc3cd0fa97599144e6c794d/1606667535554/leica_1600_b_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d621.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD621 | 5448 bytes |
SHA-256: f1a1040b01d973566b9d8371d46d1bf381965fb0ce885352e0b42427232a5c3d |
|||
font_01_sfnt_off0000e887.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE887 | 1800 bytes |
SHA-256: 51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0 |
|||
font_02_sfnt_off0000f115.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF115 | 10620 bytes |
SHA-256: 74398a9d1fda1b698d434d8dcc1aab957ade0a018eb8d9c5855c1625010d824a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.