MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains a large number of embedded links, with one identified as a malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains URLs that are likely part of a link farm designed to lure users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=social+interactionist+theory+language+acquisition
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://4ab5c431-c835-4b68-b0bb-d0ac3a6c89b2.filesusr.com/ugd/80685d_4d469d1913704360b70d15637ba40c6f.pdf?index=true
- https://acbaf6e0-36e8-45c0-807e-e111432e5b6b.filesusr.com/ugd/f91cf1_84e2daf27bc74ca4b25f27a0504e73d7.pdf?index=true
- https://c0058fc2-00a2-416a-b3ad-e701e2f8550f.filesusr.com/ugd/70094d_a71ddcc6b5ff4339aa7095293b717068.pdf?index=true
- https://0858be63-64de-474f-9f1a-ca8b2f545a07.filesusr.com/ugd/b42fd6_913b2af5e670409dad137a76ae1257ff.pdf?index=true
- https://1701e50f-0fe7-41e1-af7a-7b675e26dca4.filesusr.com/ugd/ebcc4b_2950af4387af46139f498cbeb4790a0c.pdf?index=true
- https://09ec3ea6-5eb2-4976-8c94-d6d88ec195a0.filesusr.com/ugd/4fb05f_cae3b36df36445859259e04e3605bec1.pdf?index=true
- https://bc29d534-c3d5-4c3c-898f-e945fe6c6993.filesusr.com/ugd/5c9621_2305e81eaa8145418241e446655ef425.pdf?index=true
- https://8fedd1da-b23c-48d1-9702-e7492d590b2f.filesusr.com/ugd/f55bec_54b72044d57f4d06b5da340e4109aa00.pdf?index=true
- https://cdn.shopify.com/s/files/1/0429/4000/6559/files/general_knowledge_questions_and_answers_2018.pdf
- https://cdn.shopify.com/s/files/1/0438/4079/8885/files/rexidutexitigixireba.pdf
- https://cdn.shopify.com/s/files/1/0463/2798/8385/files/judul_skripsi_akuntansi_sektor_publik.pdf
- https://cdn.shopify.com/s/files/1/0431/6961/1930/files/mesezakesinesogo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005e0a.bind5a9a58f0dede500f07330ac41464af2183995eb84415054952c9e8e0cddba47 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5E0A | 5392 bytes |
font_01_sfnt_off0000705f.bind20165df77851d2aa25b8b6587f541b46b8a8ed07ddff9d280977613cec68a01 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x705F | 10332 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.