MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, with one identified as a malicious redirector. The ML classifier strongly indicated maliciousness. The document body, though heavily obfuscated, contains a URL that is also present in the embedded link list, suggesting a coordinated effort to direct users to malicious sites. The presence of many links points towards a link farm or SEO spam campaign.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=el+imperio+de+lo+efimero+lipovetsky+pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0433/2371/9845/files/67110197506.pdf
- https://cdn.shopify.com/s/files/1/0438/0642/5249/files/rupiletivetawajuwigomobo.pdf
- https://cdn.shopify.com/s/files/1/0428/4638/8380/files/sawebotupewepukasenug.pdf
- https://cdn.shopify.com/s/files/1/0431/8937/1044/files/bigilimamotumomanaregopo.pdf
- https://static.usrfiles.com/ugd/b8c837_9279de599f68444c995f795baf3c8916.pdf
- https://static.usrfiles.com/ugd/b8c837_4ce50a00bcfa4c2d85261539ac5df8fb.pdf
- https://static.usrfiles.com/ugd/b8c837_e1760bbff70741498c48c50d3f151b1b.pdf
- https://cdn.shopify.com/s/files/1/0431/0056/9766/files/phonics_activity_sheets_for_grade_1.pdf
- https://cdn.shopify.com/s/files/1/0429/1022/0447/files/zojopisuk.pdf
- https://cdn.shopify.com/s/files/1/0433/0097/8853/files/76083257951.pdf
- https://static.usrfiles.com/ugd/b8c837_580575a57c014bba9314d1ad3098713d.pdf
- https://static.usrfiles.com/ugd/b8c837_c40a06dee65b4ebbbabd8150b28c8d04.pdf
- https://static.usrfiles.com/ugd/b8c837_5a3ad819ca7040918230151a692985cc.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005f11.bin2c5fc9141c3dfbb934f5aa3cacc79d8b79e4d40803e4bda45cf5e4cdb3474bff |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5F11 | 5160 bytes |
font_01_sfnt_off0000709f.bin85fe64d8930ca5f0a3f54040a2a4e0c6145b2bf3841ffff9e0882cfab015f91f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x709F | 11132 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.