MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier indicating a high probability of malware. It contains a large number of external links, suggesting a link farm or phishing attempt. One of the embedded URLs, 'https://trafftec.ru/123?utm_term=holiday+hearts+cast', is a primary indicator of malicious activity. The PDF structure and embedded content are consistent with attempts to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafftec.ru/123?utm_term=holiday+hearts+cast
- https://cdn-cms.f-static.net/uploads/4427781/normal_5fa042871ad5b.pdf
- https://bipalokepug.weebly.com/uploads/1/3/4/4/134492575/lexukulawiniwuz.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/xisakazelelinim/pozufawot.pdf
- https://s3.amazonaws.com/matogapibelifiv/tv_guide_bright_house.pdf
- https://uploads.strikinglycdn.com/files/8b256737-d9c7-4dc9-b2b9-d177f7fe73b1/nakorot.pdf
- https://uploads.strikinglycdn.com/files/3bd2d67e-5d5b-4928-a702-fd10b1b92867/dragonfly_helicopter_price.pdf
- https://uploads.strikinglycdn.com/files/fcd7ec67-7d59-4e17-bfa5-41c8178d3583/mejapesibuwigab.pdf
- https://uploads.strikinglycdn.com/files/44e8ed8a-9b50-4acb-b36e-5c962bfb4540/takimozilofuvop.pdf
- https://uploads.strikinglycdn.com/files/b1696d2e-c923-4d2f-86f8-e1000c1b2ec7/rolujetowatanapadav.pdf
- https://s3.amazonaws.com/zuses/how_many_bottles_of_water_equal_a_gallon.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ce1f.bin91f5641c9b5a0102b3825081e253b19d2fb0123ac199b5ac4c203548f009598f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCE1F | 4772 bytes |
font_01_sfnt_off0000de6b.bin4e797e279c80b86c24f23bb6f01b28a442b035c1667b3990b50e627edc64c0a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE6B | 11012 bytes |
font_02_sfnt_off00010422.binff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10422 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.