MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link to a known malicious redirector, indicating an attempt to lead the user to malicious infrastructure. The document body, though heavily obfuscated, contains text that appears to be a lure for a 'Plockmatic 310 parts manual', likely to entice clicks. The presence of numerous external PDF links, many pointing to file hosting services, suggests a link farm or SEO manipulation tactic to distribute the malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/123?keyword=plockmatic+310+parts+manual
- https://cdn-cms.f-static.net/uploads/4373778/normal_5f8a13b06df86.pdf
- https://cdn-cms.f-static.net/uploads/4366639/normal_5f8a8e8a925e5.pdf
- https://cdn-cms.f-static.net/uploads/4378405/normal_5f8ccb468b566.pdf
- https://cdn-cms.f-static.net/uploads/4379485/normal_5f8c385ec3e32.pdf
- https://cdn-cms.f-static.net/uploads/4367912/normal_5f8ab5ba64a3b.pdf
- https://cdn-cms.f-static.net/uploads/4369648/normal_5f8d3e4c9e417.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/fde96813-9902-4cc9-a897-a819fc761a67/puvimiwixe.pdf
- https://uploads.strikinglycdn.com/files/396f4264-f5e0-406b-b7ca-f8e18f6efd6e/78044682659.pdf
- https://uploads.strikinglycdn.com/files/52f266ff-cb25-484b-b64f-6d8a874e99e9/jejobuwufubinoj.pdf
- https://uploads.strikinglycdn.com/files/542e0565-69d1-4f28-8391-1c8b93682297/kererufovuf.pdf
- https://uploads.strikinglycdn.com/files/96ef1469-80e0-474c-94cf-618f45289c0b/66295707588.pdf
- https://cdn.shopify.com/s/files/1/0497/8494/6850/files/nof_osteoporosis_guidelines_2020.pdf
- https://cdn.shopify.com/s/files/1/0433/5704/4890/files/dissolved_oxygen_and_aquatic_primary_productivity_lab.pdf
- https://uploads.strikinglycdn.com/files/68a3b22f-1516-4390-90ed-61a02b816d49/the_stranger_in_the_photo_is_me_examples.pdf
- https://uploads.strikinglycdn.com/files/054853e0-ab24-457d-b1b7-232a03f23947/46992713633.pdf
- https://uploads.strikinglycdn.com/files/6b366c90-536b-439f-8b48-2b11d4817902/lakejiru.pdf
- https://uploads.strikinglycdn.com/files/c2e609f0-9176-43af-bfe1-62ae88c644ef/96152247202.pdf
- https://uploads.strikinglycdn.com/files/c188558c-b499-4d2c-a4db-3bfb4654967b/best_ark_dinos.pdf
- https://uploads.strikinglycdn.com/files/479b07ac-8c20-4b46-8201-eece3f181486/nogemaz.pdf
- https://uploads.strikinglycdn.com/files/25ea65cd-916f-43d8-b262-e6caf402f312/depamonazeruj.pdf
- https://uploads.strikinglycdn.com/files/7d101ac4-0889-4d50-b0ae-0371a678af3a/64300516297.pdf
- https://uploads.strikinglycdn.com/files/7637615e-58ca-4de0-8a28-fabce78a086d/45135256757.pdf
- https://uploads.strikinglycdn.com/files/c37557e3-a086-410e-a637-d6f585fc6f8b/kojerososotumu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004e1d.bin75fd1b8ce65c7795355b12ce0fa099c8f678a0676c8752e6309585707c720ce6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E1D | 5500 bytes |
font_01_sfnt_off000060b5.bindd2a9308bd1a77a02a8c49dccd3e2906762410cc16575f6d32502b56b6f63433 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x60B5 | 9508 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.