MALICIOUS
144
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it uses an advance-fee scam lure, presenting itself as an invoice or prize notification to entice users. The embedded URL, 'https://traffnew.ru/strik?utm_term=capitalist+monopoly+online+multiplayer', is the primary indicator of a malicious redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/strik?utm_term=capitalist+monopoly+online+multiplayer
- https://menufepu.weebly.com/uploads/1/3/1/1/131163725/raturu.pdf
- https://vumorusumanipav.weebly.com/uploads/1/3/4/2/134234742/ruwozejopitobovo.pdf
- https://varalege.weebly.com/uploads/1/3/0/7/130738576/13fe69086b.pdf
- https://cdn.sqhk.co/kibizatududo/Q64gjhe/alarm_clock_sound_app.pdf
- https://kelobutino.weebly.com/uploads/1/3/0/9/130969458/de1873099dc7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/6221cf1b-89fc-47ee-b7f1-5967a7056506/rovotaditapedatuxaxigavu.pdf
- https://uploads.strikinglycdn.com/files/25c95060-b8e9-4564-b3e9-5830f29c9391/83278600498.pdf
- https://uploads.strikinglycdn.com/files/fb2a2b57-7ca4-4b1a-93e5-fe91d8899acf/31344021966.pdf
- https://uploads.strikinglycdn.com/files/66b5fe48-fe72-4108-bbb6-b3ef63678c48/mikujopi.pdf
- https://uploads.strikinglycdn.com/files/0f3f0bf5-d536-4667-b931-079d24ce2c40/path_of_exile_sli.pdf
- https://uploads.strikinglycdn.com/files/8f4d34c8-f20b-4e54-9290-3e932bbc17ca/39185395374.pdf
- https://uploads.strikinglycdn.com/files/b0171987-7074-4122-9e8b-d69e3492d500/craftsman_gold_6._75_lawn_mower_oil.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000212ab.bin484584ac8121ac1c648bdd8dde5d44bfc4b2b494d49a82b9f66b6fe62a3f2c85 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x212AB | 4972 bytes |
font_01_sfnt_off0002237f.bin31c907c36e6e0321aad0de9ddec54610e23dd6cacfc6decf4a122da9e390bab7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2237F | 15516 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.