MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. The presence of an external URI pointing to 'traffking.ru' suggests a potential command and control or download server. Although no scripts were explicitly extracted, the PDF structure and the ML detection indicate a malicious intent, likely to deliver a secondary payload or conduct phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffking.ru/aws?utm_term=flexible+plywood+for+concrete+forms
- https://cdn-cms.f-static.net/uploads/4383688/normal_5f8d0dca67d90.pdf
- https://cdn-cms.f-static.net/uploads/4425511/normal_5fad6a495e1fe.pdf
- https://cdn-cms.f-static.net/uploads/4369163/normal_5f91347351463.pdf
- https://cdn-cms.f-static.net/uploads/4368978/normal_5f90c711f00bd.pdf
- https://static.s123-cdn-static.com/uploads/4463794/normal_5fc3f59b089d2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a0ab6425-96aa-405f-b24b-dce61af2a124/bavalu_sayya_song_download_naa_songs.pdf
- https://uploads.strikinglycdn.com/files/889f6d4d-04b7-4e7e-8586-3cc686b62b51/gta_trk_hileleri.pdf
- https://uploads.strikinglycdn.com/files/9dd7f7a1-98d7-450a-b174-f445e514c920/agneepath_1990_full_movie_free_download_3gp.pdf
- https://uploads.strikinglycdn.com/files/8ccf2adb-7819-4a40-bf41-3c370beae7ae/mikawovuvejikiwuj.pdf
- https://uploads.strikinglycdn.com/files/204da3c4-91ba-4f21-8385-f86e259b7e3b/alterac_valley_rep_guide.pdf
- https://uploads.strikinglycdn.com/files/ce50f0dd-31e0-4f07-8366-70ae4e95dfc0/jevitafoluzosikirodapik.pdf
- https://uploads.strikinglycdn.com/files/c29ce518-3fc0-42fd-865e-bb47e62fe217/7926043952.pdf
- https://uploads.strikinglycdn.com/files/ae9c95a0-c742-42b7-95f7-bcdf3622d829/9599980990.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c8a9.bin1230ce49690f101a156a40e57026f1d17a58089a7806c4775c571ade53ee9b6e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC8A9 | 5448 bytes |
font_01_sfnt_off0000db3e.bin79ec6b59e16af4c0cfaf3d6c4e8901d291ed913a628d7909edc1f42ca4ee1176 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB3E | 11000 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.