MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. This indicates an attempt to lure the user to a potentially harmful website. The ML classifier also strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the nature of the redirector suggests a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/123?utm_term=lexmark+t630+parts+manual In PDF document text
- https://cdn-cms.f-static.net/uploads/4447093/normal_5fd8568f98413.pdfIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://static1.squarespace.com/static/5fc56aec88c99b6d37c5a745/t/5fcffdcf7b0a801071fa9863/1607466450467/mesuwinojojisuzuxiges.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/393b10ce-1d10-47a0-bc26-4250055d582c/loresodubojiko.pdfIn PDF document text
- https://s3.amazonaws.com/voxulija/karma_dog_training_scam.pdfIn PDF document text
- https://s3.amazonaws.com/kujapomib/28443761897.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ea61eb77-4a77-42fd-82cb-1417da5ddcfb/mutilixezelosidipolokow.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0fbd9104edf1d778138b3/t/5fcd26bd24c49707d327cff2/1607280318481/27262762011.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a861f1c-89f3-4330-a99f-74abbc03ed4f/hulk_emoji_answers.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe0a6ef3de5e49b52b610e/1606290032233/google_easter_eggs_2020.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc7a94381fec00968438b4e/t/5fd0eddb65d4c21e5f9a15a8/1607527900877/zarchiver_mod_apk_happymod.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/07268dfa-a3d9-4581-947f-8501c3139ea7/34970881735.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf3953570fb44d1c8743e/1606284181564/minecraft_force_op_unban_tool.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2cdc83c5-6fc6-4eb6-af03-1997a7c1ee2e/ps1055lcp_power_sentry.pdfIn PDF document text
- https://s3.amazonaws.com/vavebufevodutob/dizirogezi.pdfIn PDF document text
- https://s3.amazonaws.com/bolovopizonuki/girilupere.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cda28496-abcc-4050-b106-88a9626b7990/shelby_high_school.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_006_off00010e55.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x10E55 | 8476 bytes |
SHA-256: 5adf891887e2b6b6cccd359d16d04c271b57f1f5419cb32413e90802c975c2f4 |
|||
stream_008_off00015fe7.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x15FE7 | 20440 bytes |
SHA-256: b0fb3b5061e012c9970e8211177e2cc47e9fffa3c54b56bbb6d35151365be50e |
|||
font_00_sfnt_off0000dc7b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDC7B | 5884 bytes |
SHA-256: 2716da04e293f1ab6b330ba3e6bdaa269d751b9fa44ba69107b937b87a41480c |
|||
font_01_sfnt_off0000f066.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF066 | 5496 bytes |
SHA-256: ff3983de540ddbf749eb125986c1cd82ffdee58c93fed819528af1acf5070969 |
|||
font_02_sfnt_off000102fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102FC | 3720 bytes |
SHA-256: d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281 |
|||
font_04_sfnt_off000125f8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125F8 | 20252 bytes |
SHA-256: a50e7d05808d88176987b1e7d9472ab5d2ba9fe3234365d6557277cc61404e7b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.