MALICIOUS
116
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with one specifically pointing to 'traffking.ru', suggesting a link farm or phishing attempt. The 'SE_CALLBACK_LURE' heuristic indicates the document may prompt users to call a number, consistent with scam patterns. Although no scripts were explicitly extracted, the presence of embedded URLs and the ML classification strongly suggest malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffking.ru/123?keyword=harlem+school+district+122+skyward
- https://cdn-cms.f-static.net/uploads/4387410/normal_5f956fd1dc7b3.pdf
- https://kevugekakizuxo.weebly.com/uploads/1/3/4/4/134481001/5a91eb45427.pdf
- https://cdn-cms.f-static.net/uploads/4387582/normal_5f8eb393e6cf7.pdf
- https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/meketuxasiwet.pdf
- https://mavobomuwatu.weebly.com/uploads/1/3/4/5/134592479/218491.pdf
- https://namonizumus.weebly.com/uploads/1/3/4/3/134345036/zowotomexozu_xojomuboriful.pdf
- https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/fogofupasog.pdf
- https://cdn-cms.f-static.net/uploads/4370309/normal_5f9fa3c241ab7.pdf
- https://cdn-cms.f-static.net/uploads/4379369/normal_5fa3dbcda9185.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fegamal.files.wordpress.com/2020/11/advantages_of_technology_in_communication.pdf
- https://s3.amazonaws.com/megodipewukitoj/pdf_to_word_converter_paid_apk.pdf
- https://dowuwiridewe.files.wordpress.com/2020/11/97555239798.pdf
- https://zorowute.files.wordpress.com/2020/11/xukadidomozu.pdf
- https://mutozofe.files.wordpress.com/2020/11/65548376527.pdf
- https://lodoxepal.files.wordpress.com/2020/11/vibinofa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006115.bindfbf4ccc8c26c0a5a5fc39092aecbc140dc146279a0b22614027d5937a71c659 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6115 | 5580 bytes |
font_01_sfnt_off000073fc.bina36c75d0ce1eafec0abb12b1c6055a088e060ca1b71f3b6d68a2c24875eb969f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x73FC | 10292 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.