MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document uses a lure of sheet music to trick users into clicking a link. This link, https://cctraff.ru/123?utm_term=joy+to+the+world+unspeakable+joy+sheet+music, redirects to other URLs, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/123?utm_term=joy+to+the+world+unspeakable+joy+sheet+music In PDF document text
- https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/7294463.pdfIn PDF document text
- https://ribuborufexegax.weebly.com/uploads/1/3/4/5/134507127/b196bacdc05fb46.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420927/normal_5fa6c2b769a09.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376127/normal_5f9564444496a.pdfIn PDF document text
- https://taruzabob.weebly.com/uploads/1/3/4/4/134493447/zabugerom-boruzewogon-nidifeba.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388629/normal_5f935bb2ab050.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f8721f7a1c43.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456660/normal_5fa378599b85c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4474462/normal_5fb4423ec3b0e.pdfIn PDF document text
- http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000b239.bin)
- http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000b239.bin)
- https://uploads.strikinglycdn.com/files/bca53089-87fe-4b96-a58b-b0b174419434/expedient_definition_in_english.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87bbff43-a3d9-4433-a7b9-eb3abaef76d0/35146515077.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86869a37-77d9-4545-ad40-b00f4ac48272/fuxebuji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5441608-1f9d-47a3-b958-37803e116690/31432224902.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000b239.bin)
- http://dejavu.sourceforge.netIn extracted file (font_02_sfnt_off0000eb78.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_02_sfnt_off0000eb78.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b239.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB239 | 5776 bytes |
SHA-256: 78160c7c802197c9395fe02649525c95f91fbffb87cc748f8bc7b04528d9729e |
|||
font_01_sfnt_off0000c5c7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC5C7 | 11592 bytes |
SHA-256: b8b0a8834adc13eb5b7b906c916e25c1fa1b1780c325fadb3aec8812a9b65bfb |
|||
font_02_sfnt_off0000eb78.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB78 | 16120 bytes |
SHA-256: fb7b45e24c28c4473d0ca1c6410c593992d9a809009f9c41b5ae32c9142507dd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.