MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is a PDF document that contains a large number of external links, many of which are to other PDF files, suggesting a link farm or SEO abuse. One of the embedded URLs, 'https://traffnew.ru/strik?utm_term=tag+heuer+formula+1+manual', is flagged as suspicious. The document body, though heavily obfuscated, contains references to 'Tag heuer formula 1 manual' and the authoring application 'wkhtmltopdf', indicating a potential lure. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/strik?utm_term=tag+heuer+formula+1+manual
- https://bozudikejud.weebly.com/uploads/1/3/4/5/134519676/7128943.pdf
- https://mapikomuxet.weebly.com/uploads/1/3/4/5/134579134/1270059.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/zirojopemup/joviwerumip.pdf
- https://uploads.strikinglycdn.com/files/67c76f50-458f-4cac-84e3-e81f1c416362/short_and_happy_guide_to_constitutional_law.pdf
- https://uploads.strikinglycdn.com/files/df3f126b-eb4b-47a1-aaa8-e9b75b15dabc/26612951787.pdf
- https://s3.amazonaws.com/jiwisi/trig_ratios_worksheet_key.pdf
- https://s3.amazonaws.com/desenaz/i_got_a_bbq_stain_on_my_white_t_shirt.pdf
- https://s3.amazonaws.com/gawabog/nba_live_mobile_apk_raw.pdf
- https://uploads.strikinglycdn.com/files/df99143f-a77b-4103-bb6b-8deba8d58f58/toporagabad.pdf
- https://uploads.strikinglycdn.com/files/0cd3264d-83c0-4d3e-a3c3-57fa1a8c66ea/audi_a6_service_manual_free_download.pdf
- https://uploads.strikinglycdn.com/files/efb89db2-fff9-46de-a85c-8c7d8ae066c3/40236101521.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ae8d.bin96601114c985d014bd9158dcc1c3e3812081b712c142616d1760502e02c7a907 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAE8D | 5004 bytes |
font_01_sfnt_off0000bf6f.binbe74ed098147f23f8dc5027f96b1c37a356b5eb45f852fb663c6eccdfb8c3e9b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBF6F | 10384 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.