MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'trafftec.ru', which is likely part of a phishing or redirection scheme. The document body, though heavily obfuscated, suggests a lure related to product sales, consistent with phishing tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafftec.ru/123?utm_term=shoe+heel+pads+for+blisters
- https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/zabajufu-femudana.pdf
- https://zilowefid.weebly.com/uploads/1/3/4/5/134510497/vabiz_kexinijipobotu.pdf
- https://ralikinu.weebly.com/uploads/1/3/4/8/134883141/nopasuxoravoki.pdf
- https://movireralu.weebly.com/uploads/1/3/4/8/134879142/8f2e5e3fb0.pdf
- https://ratanamiwul.weebly.com/uploads/1/3/4/3/134327333/sixajavad.pdf
- https://rukagevilatixa.weebly.com/uploads/1/3/1/6/131608017/muwumiwifaja.pdf
- https://jimagofer.weebly.com/uploads/1/3/0/8/130813953/katuram.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/e6a9a89b-ea75-4324-bad8-8ffe058e417f/36175898085.pdf
- https://uploads.strikinglycdn.com/files/ac341703-5bc4-4123-be86-ed41a8ac80b8/javiduwube.pdf
- https://uploads.strikinglycdn.com/files/9dc95bb8-91a3-417f-854c-36ad3d422f24/kerilozim.pdf
- https://uploads.strikinglycdn.com/files/5ae43f29-d9cf-492f-bd46-379e096fcab6/nice_words_that_begin_with_the_letter_r.pdf
- https://uploads.strikinglycdn.com/files/078c6524-9e6d-4630-bcdb-6ba898199d3e/lokojaxe.pdf
- https://static1.squarespace.com/static/5fc2f8256b97992eb5696e44/t/5fd20ffe7cf94534dc624114/1607602174752/chess_set_wooden_for_sale.pdf
- https://uploads.strikinglycdn.com/files/aeb4607a-e7b6-41e1-809b-f8b4ce8effd3/13243282365.pdf
- https://uploads.strikinglycdn.com/files/db933eb1-e784-4768-92c7-76b3b1b3efef/aptitude_questions_for_infosys_with_answers.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c177.binf2e86fe613e10a9132d7cf5b41b264b7824bb5d09c2768e7fd893065a2ff3c55 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC177 | 5372 bytes |
font_01_sfnt_off0000d3aa.bin8424d234f0c881d6135342fc48ba51bb7cd6d56606c2a61edc04b4e22f5f4f77 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD3AA | 10912 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.