MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains heuristics indicating it is a malicious redirector, linking to known malicious infrastructure. The ML classifier also flagged it with high confidence. The embedded URL, 'https://cctraff.ru/aws?utm_term=analytics+report+chart+salesforce', is the primary indicator of malicious intent, likely serving as a lure for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 3
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/aws?utm_term=analytics+report+chart+salesforce In PDF document text
- https://cdn.sqhk.co/jalafimimodo/YAHfwJ6/the_financial_advisers_act_2008.pdfIn PDF document text
- https://cdn.sqhk.co/gadukupuwe/Ijghh6c/51673666764.pdfIn PDF document text
- https://cdn.sqhk.co/lixozimiz/chax0pg/71922300050.pdfIn PDF document text
- https://cdn.sqhk.co/joxomawezu/jjgjijQ/adafruit_audio_fx_sound_board_troubleshooting.pdfIn PDF document text
- https://cdn.sqhk.co/jafetegupam/ibgc5gg/craftsman_snowblower_won_t_start.pdfIn PDF document text
- https://cdn.sqhk.co/muzubasiwu/heghJE5/hitman_2_gold_edition_contents.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bupaxomu/68569122100.pdfIn PDF document text
- https://s3.amazonaws.com/pazatuv/86937078326.pdfIn PDF document text
- https://s3.amazonaws.com/megodipewukitoj/97320571707.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55747427-2c6c-4881-be05-07bd00863668/31781991563.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/39a3cffd-1fc2-4294-a329-d356751cbe1b/9961745436.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be52b350-f42a-4164-b4e1-780865f5bd6e/mulevawamini.pdfIn PDF document text
- https://s3.amazonaws.com/dutuzanob/bitmoji_apk_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbf4d54a-fc28-4373-b99d-699a04bf1106/pepimusamesuvelozarexeto.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f58e2cb-b181-43b5-a743-7e243e37d6bf/88724856297.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files/ratio_and_proportion_aptitude_questions_with_answers_in_hindi.pdfIn PDF document text
- https://s3.amazonaws.com/kosipefojaw/denokiwaxedupiwite.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000de33.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE33 | 5192 bytes |
SHA-256: d2f1c3994d81756f172af4ca90f3caa56f2e94a2ca6456cb70c2a93161674c76 |
|||
font_01_sfnt_off0000efe5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFE5 | 11084 bytes |
SHA-256: 05c9759a4c55183f1385a725a4ce2d625f09a165d3810969205b97dc2aab1626 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.