MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a link to a known malicious redirector, which is designed to lead users to phishing or malware sites. The document body, though heavily obfuscated, suggests a lure related to 'Sharepoint migration interview questions and answers' to entice users to click the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/strik?utm_term=sharepoint+migration+interview+questions+and+answers
- https://cdn-cms.f-static.net/uploads/4370785/normal_5f8c8b12315fe.pdf
- https://cdn-cms.f-static.net/uploads/4377109/normal_5f9896ba5f88e.pdf
- https://cdn-cms.f-static.net/uploads/4367911/normal_5fbdd4d75bd82.pdf
- https://cdn-cms.f-static.net/uploads/4414515/normal_5f9bb8361205f.pdf
- https://cdn-cms.f-static.net/uploads/4402940/normal_5fbb9f963dc13.pdf
- https://cdn-cms.f-static.net/uploads/4464083/normal_5fb773e77018d.pdf
- https://cdn-cms.f-static.net/uploads/4370284/normal_5fb4cddc44201.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/wajufifenoxuj/53258935916.pdf
- https://s3.amazonaws.com/rijaliwiguvex/98074814841.pdf
- https://s3.amazonaws.com/loranoduzuja/58812052397.pdf
- https://s3.amazonaws.com/wekibik/zumuwalodakiw.pdf
- https://s3.amazonaws.com/vaxebisapesi/oxford_dictionary_offline_for_android.pdf
- https://s3.amazonaws.com/tawovojo/gasejoletazamofubitaseju.pdf
- https://s3.amazonaws.com/rixevozajixezos/human_body_template_free.pdf
- https://uploads.strikinglycdn.com/files/d05742f0-c287-40ca-b3c2-b3b09457b7d7/8611573796.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e094.binfbe8786ebc00fd9526f2c6dac2b6d8579952d2a2a7c3f017f0ccf59aaeeae92a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE094 | 5604 bytes |
font_01_sfnt_off0000f376.bin84eb26fa96375a151f1e2b01c798c3111a7e7a87fc819c9d549a053fcf448838 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF376 | 10316 bytes |
font_02_sfnt_off00011684.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11684 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.