MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a critical heuristic firing for linking to known malicious redirector infrastructure, specifically pointing to 'ggtraff.ru'. The document body, though heavily obfuscated, contains the same URL and a large number of links to PDF files hosted on Shopify and Strikingly, suggesting a link farm or SEO poisoning attempt. The presence of a 'download button' heuristic further supports the lure of clicking a link. The ML classifier also strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/123?keyword=eu+settlement+scheme+application+android In PDF document text
- https://cdn-cms.f-static.net/uploads/4366351/normal_5f871076512bb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370087/normal_5f88bf45b2ba4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365621/normal_5f86f51012d18.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370780/normal_5f88cb1acb479.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f87804f5517f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f883b23a5745.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371806/normal_5f88c9907a5b7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367922/normal_5f88278ae1df9.pdfIn PDF document text
- https://besavikeneg.weebly.com/uploads/1/3/2/8/132815808/jodetebanud.pdfIn PDF document text
- https://xazapadikud.weebly.com/uploads/1/3/1/8/131871762/019da7bcb.pdfIn PDF document text
- https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/6082316.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0486/4789/7256/files/rubyfruit_jungle_online.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/0990/0184/files/what_are_examples_of_thermal_expansion.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/9272/0829/files/hindustani_classical_music_books.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0493/6125/6607/files/bhim_app_apk_mirror.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8503d6c0-9c67-48df-b975-3a8c841892ab/tadozigun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a39c8e90-320e-4347-a696-2e6f6c85618e/59997059364.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/202d1502-b31c-4f70-9235-26f63066f338/3175774625.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/24572bb1-4986-4bf6-a115-e9f1947d3340/26865687511.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/7027/5237/files/weight_watchers_fit_points_uk.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/0044/6113/files/kutiwilomomemogifef.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0502/8691/9845/files/arcade_cocktail_table_chairs.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/4362/5880/files/14567086260.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/9313/1425/files/jagujemi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006a5f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A5F | 5152 bytes |
SHA-256: 58d6ff78cdefe03c3609cddb24801985bf988db622bd323dbd56ca08a8e17d89 |
|||
font_01_sfnt_off00007bab.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BAB | 9816 bytes |
SHA-256: 405a2021b6e90a4bfd397f2c7f32a4ccfb94bf820eb18833dfa383c0b822729e |
|||
font_02_sfnt_off00009d54.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9D54 | 4324 bytes |
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.