MALICIOUS
212
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document contains a critical heuristic firing for a malicious redirector link, directing users to `https://cctraff.ru/wb?keyword=columbia%20law%20school%20course%20guide`. It also exhibits characteristics of a PDF link farm, with numerous embedded URLs. The ML classifier and ClamAV detection further support its malicious nature, indicating it is likely a phishing or trojan delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9757
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/wb?keyword=columbia%20law%20school%20course%20guide In PDF document text
- https://vasinurevesodux.weebly.com/uploads/1/3/4/6/134605286/e305197.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366623/normal_5fd2aceccf123.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495254/normal_5fd1e3b6d4f86.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383804/normal_5fb6736a929b3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4994c89b-14f3-4a50-9bff-ed2174256d3b/miller_park_billy_joel_concert.pdfIn PDF document text
- https://s3.amazonaws.com/didowugorokirug/opera_browser_for_android.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b91817e-edc3-4d0f-b188-d83fc5dae0bf/23935011282.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/883e38ea-8fa3-4edb-a03e-2ef4abefd01f/99413812697.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/325989ab-4372-4af0-8c12-a81da861fb42/david_brown_990_selectamatic.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e881981-190e-4bfd-af75-5371737f3d00/singer_sewing_machine_model_3337_user_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6aae9430-aa5a-4951-a995-78c07130a911/suratasuxipig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45671da7-2534-4008-917b-df15c6d41546/50992271247.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d2de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD2DE | 5492 bytes |
SHA-256: f44219127b979379972ba2ae02b895ba33283fed0e568ca811369113119cfb8c |
|||
font_01_sfnt_off0000e565.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE565 | 10964 bytes |
SHA-256: b2bf221d8cc4576948d386060c154dee1220ffd02e5c833ded1de594ae1f809c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.