MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains text suggesting it is a 'teacher's book', likely a lure. The primary malicious URL identified is 'https://ttraff.link/pify?keyword=solutions+elementary+teacher%2527s+book+2nd+edition+pdf', which is used to redirect users to other potentially malicious PDF files hosted on mozfiles.com.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/pify?keyword=solutions+elementary+teacher%2527s+book+2nd+edition+pdf In PDF document text
- https://site-1036944.mozfiles.com/files/1036944/lesamatasinopitipixesujoz.pdfIn PDF document text
- https://site-1036691.mozfiles.com/files/1036691/56393023802.pdfIn PDF document text
- https://site-1048488.mozfiles.com/files/1048488/basozudakagimuzulez.pdfIn PDF document text
- https://site-1037909.mozfiles.com/files/1037909/52125823692.pdfIn PDF document text
- https://site-1039320.mozfiles.com/files/1039320/nojanek.pdfIn PDF document text
- https://site-1038653.mozfiles.com/files/1038653/pesamibep.pdfIn PDF document text
- https://site-1036693.mozfiles.com/files/1036693/83159865203.pdfIn PDF document text
- https://site-1037024.mozfiles.com/files/1037024/dufoloruvax.pdfIn PDF document text
- https://site-1039922.mozfiles.com/files/1039922/7458206379.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/7857/3468/files/11943601983.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0492/3326/4806/files/aliso_viejo_movie_theatre.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/3336/5146/files/the_perfect_ppm_worksheet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/8761/3096/files/86914870102.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/8073/5138/files/wodepo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/7738/5374/files/rorepegigojezi.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0439/0292/7003/files/iptables_cheat_sheet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/3894/0570/files/bomin_golden_child_instagram.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/4960/2209/files/fagolumoda.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0485/7446/4160/files/fikabulegizatowalugiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bfcbd26a-c4f2-4279-9fad-c695f9ad1f4b/bikuxidiziju.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8580127-23c6-46fd-911a-6f20f06006e7/gozezi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2f12913-a653-428b-84e5-1e84b57aeee3/9564269251.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e1460aa-cc82-4c54-ba53-850454eabe2d/46235647954.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b110c95-a36f-4c56-a8f3-6b194e699d88/zerapibewugidilepegi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7aa70370-ce33-4218-bbc8-5687765f2ac8/55568077085.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec1870fc-4f8b-487d-88bd-cf2f354071a3/rafagivisu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aba15a0c-f4d9-4bee-97bc-2aaae9c7afcf/7683034946.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006e22.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6E22 | 5968 bytes |
SHA-256: efef0c4141ee47a47cd58170307b0cef0664698cb896e7b4aa3f02fc4031f422 |
|||
font_01_sfnt_off0000824d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x824D | 11660 bytes |
SHA-256: 1d61bc2ecf481f4c4d74c1f4fc750d28b9fa6f94025e18e38c9fb2823f0793e0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.