MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple critical heuristics as malicious, including a redirector link and a link farm. The embedded URL `https://cctraff.ru/123?utm_term=flauta+para+tocar+musica` is identified as a malicious redirector. The presence of numerous external links suggests an attempt to direct users to potentially harmful content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/123?utm_term=flauta+para+tocar+musica In PDF document text
- https://ludalobupum.weebly.com/uploads/1/3/4/5/134528654/waxugesuxukiv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450038/normal_5fb870f23d9f7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425229/normal_5f9ac46b3b7e2.pdfIn PDF document text
- https://xonuveviriniw.weebly.com/uploads/1/3/0/7/130738603/fajeguxako-wodom-taziwifiwakodil-gitin.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf69d08845d09244fc387/1606284958391/41515351349.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0eb79e5c7695ca99bb922/t/5fc0fad4e18c5c478e1eddef/1606482647490/kenmore_70_series_washer_agitator_parts_diagram.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3cdf9f18-c159-4453-866c-de03793cc2aa/vimako.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc1858bf7cf8c75402f5531/t/5fc73dac2ac13f1ee9b77214/1606892972802/tuxarotajifiwofa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9140364e-8dcc-4f29-8a31-c69552e77afc/wufipigavelujomupav.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0e703bda9c57a97be38fb/t/5fc5dbc23c6ccf69f32a1f88/1606802371158/parent_sign_in_sheet_for_daycare.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc177dbbf71053ccb142dd9/t/5fceca78cd9a2056ff63a018/1607387769150/cyber_fire_free_battle_royale_shooting_game_apk.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc50ab95687f52b6b9bd685/t/5fcfe8dea81a80360e87db42/1607461088141/sokevapogironebamekuxu.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc2a892ab79f442f234dd8a/t/5fcb56289cf56e0e8b0fd8fa/1607161384613/equalizer_3_trailer_german.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbffc42bda9c57a97b92422/t/5fc0d9142dd96f59180f2d14/1606474005267/zotizibujimofetesa.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf57fd3485235c86bd8bf5/1606375422842/ctek_3300_manual.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc4d1fde5c7695ca9b4aca3/t/5fccb361f94b6402b216c317/1607250786195/religion_meaning_in_tamil_for_english_words.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb1e4e70-91b0-4edf-9940-df169091c46d/argument_list_too_long_python.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013b51.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13B51 | 3592 bytes |
SHA-256: cbb147c24831711b1e94c0624b042bab1ff9a88da935b291dc31d2d07114f69e |
|||
font_01_sfnt_off00014829.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14829 | 5032 bytes |
SHA-256: e0f43496369f47565acc5e93840847c235e8904bb046efb33276e7e43873cd86 |
|||
font_02_sfnt_off00015930.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15930 | 11948 bytes |
SHA-256: f5cff6e707d4b5b94fd56d3798dd983fdacedc4b644bf59573e88baa2b1d1af9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.