MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document is classified as malicious due to its structure, which contains a large number of embedded links pointing to external resources. The primary link, 'https://ggtraff.ru/aws?keyword=how+not+to+write+a+novel+pdf', is identified as a malicious redirector. The document's content appears to be a lure, disguised as a PDF about writing a novel, to encourage users to click on these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/aws?keyword=how+not+to+write+a+novel+pdf
- https://cdn-cms.f-static.net/uploads/4369331/normal_5f8a3efbd21a7.pdf
- https://cdn-cms.f-static.net/uploads/4369160/normal_5f8f191183bac.pdf
- https://donodofi.weebly.com/uploads/1/3/1/8/131856097/remiweneja-gadubisizijul-pinelixetamoxu.pdf
- https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/xaperasopa.pdf
- https://cdn-cms.f-static.net/uploads/4376372/normal_5f8bd27ae4947.pdf
- https://belonimilulufaf.weebly.com/uploads/1/3/4/4/134403367/nugazu.pdf
- https://cdn-cms.f-static.net/uploads/4401518/normal_5f9173507308c.pdf
- https://bewupoterefi.weebly.com/uploads/1/3/1/3/131380107/dc7611a393ec.pdf
- https://keruzexutebimoz.weebly.com/uploads/1/3/4/3/134310977/deeb0.pdf
- https://suludizivot.weebly.com/uploads/1/3/1/3/131383823/b7d300133c960.pdf
- https://cdn-cms.f-static.net/uploads/4375690/normal_5f8ba130d8a78.pdf
- https://cdn-cms.f-static.net/uploads/4368497/normal_5f87e58348575.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/jurogoz_pumopafabofin_tixozakipabom_nilot.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/jibigamefomoni.pdf
- https://sopodepewujo.weebly.com/uploads/1/3/4/3/134340903/litimu_fuputawoxuv_modos_lonunovo.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/saxuvenimugugadeso.pdf
- https://mogidudurunupiz.weebly.com/uploads/1/3/2/6/132695636/rijeseka.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f8a89267b910.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/edf29d7f-cc96-4254-97bf-47cb0abf2fe9/81621417485.pdf
- https://uploads.strikinglycdn.com/files/cee86fbb-f946-402d-89cb-844668f17cf6/gel_blaster_mod_guide.pdf
- https://uploads.strikinglycdn.com/files/542cf678-f092-40cd-8a58-21c4530f2838/96500663835.pdf
- https://uploads.strikinglycdn.com/files/73da0a83-3d8b-42f2-a837-3a87077ea4c1/ruger_p89_disassembly_manual.pdf
- https://uploads.strikinglycdn.com/files/aff18c1e-3b82-47c0-8cb1-23177bf6a4ad/vodixokiwesibe.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008509.bine3bfdc53c7d061792287ad737e98d16c75530aee2d559ee570067f7b3700d7f0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8509 | 4972 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.