MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains a credential phishing lure impersonating Spotify, directing users to a malicious redirector URL. The ML classifier and critical heuristics strongly indicate malicious intent. The embedded URL `https://ttraff.club/123?keyword=invaluable+vs+valuable` is identified as a malicious redirector, and the document body contains a link to `https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/majevujug-luzokuju-zunupumumuzi-bufuwi.pdf` which is also associated with brand-impersonation phishing.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/majevujug-luzokuju-zunupumumuzi-bufuwi.pdf.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/123?keyword=invaluable+vs+valuable In PDF document text
- https://cdn-cms.f-static.net/uploads/4408713/normal_5f97bcda29bde.pdfIn PDF document text
- https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/majevujug-luzokuju-zunupumumuzi-bufuwi.pdfIn PDF document text
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/sixukejomiwewanage.pdfIn PDF document text
- https://jodotabamusunew.weebly.com/uploads/1/3/4/4/134402052/vuvifig.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405925/normal_5f95a93cb198a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6657ad6a-3adc-4f3f-8088-71f8f24fb9df/tixopefibixamejurokava.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6314640f-3355-4be3-8135-2a1b5d0fb03d/anthropological_theory_of_entreprene.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/4697/2821/files/42917962154.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/12af1a2f-6c4d-4b2a-8a92-39dc5f073d49/ejercicios_de_costos_resueltos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c7ac194-e2b8-4573-a7fa-a77835137f83/jodojerukiwusekupaval.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/4876/2529/files/cooking_class_gift_certificate_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f46e73ee-12f6-4908-933c-33757efe2fc7/94847544319.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7df275be-898b-4de6-a8ff-77388379fbc7/47509459500.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0483/6071/8485/files/19395638866.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d76bd268-94c8-4587-a343-43799958d4f7/50889089943.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5adda051-ece1-424d-88af-99c8fb63f5df/78179522310.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e004f8a8-f649-4589-8801-8eb9c439a057/88673251073.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d8bd52e-d423-4058-9dd7-9885d7b24463/fexeviwodud.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8393/2863/files/doroninadepuburalujo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8835d1ac-1ecd-44c2-9bae-0a4e28898f76/falesuzojoliwozigotazajog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50ff1780-6b10-4a5d-9158-28acb3251c80/49463935669.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001052c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1052C | 4720 bytes |
SHA-256: f105908b45e6e9b7b439905f7eba6a0b812cd02efe84be0e2ed1ebfee0a521f6 |
|||
font_01_sfnt_off0001154d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1154D | 12136 bytes |
SHA-256: 8a8287474aa5903aa2dc72852b3db1fac792032848774fd675b21db60d35cdc3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.