MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF file was flagged as malicious by multiple heuristics and a machine learning classifier. It contains a link to a known malicious redirector at `https://cctraff.ru/strik?utm_term=water+testing+labs+in+pa+certified`. The document body, though heavily obfuscated, contains references to `curl_in_cylindrical_coordinates.pdf` and `https://uploads.strikingly`, suggesting an attempt to download or redirect to further malicious content. The presence of PDF-specific malicious link indicators and the overall ML score strongly indicate a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/strik?utm_term=water+testing+labs+in+pa+certified In PDF document text
- https://static.s123-cdn-static.com/uploads/4413119/normal_5fc8aee48cf5f.pdfIn PDF document text
- https://uploads.strikingIn macro / runtime command snippet
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fbe17553-84b9-424d-9481-3cf4842715e3/porofixapu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d342e18b-85a5-4093-9878-1199dc968979/73604967827.pdfIn PDF document text
- https://s3.amazonaws.com/julexekubaj/curl_in_cylindrical_coordinates.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d363c7f4-bd67-435f-be43-abc72e2644bd/walking_dead_merle_death_episode.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d6be735-5775-4ce1-ba4b-fbf993238cfc/jivapegeninubosukak.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc7830239503a47f6fdd30c/t/5fcdb3469aa2de0c64b1eb5b/1607316299079/las_vegas_tourism_september_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9963134-593e-47e2-a8e6-21474d0a5a45/69181706236.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd1a6ae5-cdb3-481b-b3fa-30afa69fbf79/11511023833.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e01ec1e-15d6-4653-97bc-7d897660a2c9/freemie_closed_system_collection_cups_review.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0dda31452f90b7fe53205/t/5fccf5fad235d37878c7b9c7/1607267835846/pokemon_quest_cheats_switch_2019.pdfIn PDF document text
- https://s3.amazonaws.com/fasanag/teresixonibinimo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1c94224b-3597-4e2e-9435-55ff305258b8/is_academy_awards_capitalized.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c880.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC880 | 5476 bytes |
SHA-256: e02573cea4ef10dc1a319baa3d266df5daab2a07cdfc1e3d7fa52adca1515814 |
|||
font_01_sfnt_off0000db36.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB36 | 10580 bytes |
SHA-256: 2bd3bd941d2aef253aaf58ceb8a634b9d95a2d97eaa8cec81ddc9a4e1aa8c43e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.