MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains an embedded URL that redirects to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains references to "wkhtmltopdf" and a date, suggesting it was generated programmatically to present a lure. The primary IOC is the external URI pointing to a potentially malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafffi.ru/strik?utm_term=los+de+abajo+translation PDF link annotation
- https://cdn-cms.f-static.net/uploads/4381962/normal_5fd7c79773c6e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4505363/normal_5fc0a7cd64409.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe256f08845d092453af63/1606296944698/3907804839.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0b629affbf90a66e985ea/t/5fc0e46ee18c5c478e1cba6a/1606476912220/how_to_improve_my_english_speaking.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/740aae30-c064-471a-8493-30e2d2c03490/sumunipafov.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0e110403f5353fd95a22f/t/5fc52fabcb3e0f5771f74e31/1606758316703/mazow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b604fd9c-ca72-4e0b-aeb3-ea9bcb0abfca/vurikisogi.pdfIn PDF document text
- https://s3.amazonaws.com/tibitexil/jabupumek.pdfIn PDF document text
- https://s3.amazonaws.com/defujo/95986065318.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc178a7ea4a794d56491e65/t/5fc2cd507acac6192a1d2732/1606602065157/pregnancy_instruction_navy_2018.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4e5f4f98375720d6b973/1606372960138/babys_dream_serenity_crib.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e768.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE768 | 4976 bytes |
SHA-256: 53ad4b196f1ab1030e7e6828adaad4e54f102e5eb12e16de675620290e4c11b5 |
|||
font_01_sfnt_off0000f861.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF861 | 12616 bytes |
SHA-256: 78685661d860ef66be8dd3e9aec9b57bc6f0d90f24f694ea51e2d584e34da005 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.