MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded links, with one identified as a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'basic stoichiometry worksheet pdf' and a URL that appears to be part of a link farm designed to attract users. The presence of a malicious redirector and a large number of external links suggests an attempt to drive traffic to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=basic+stoichiometry+worksheet+pdf In PDF document text
- http://wabaxa.upgradedcomputers.com/uploads/1/3/0/7/130775432/rumugo-fowuzivozapij.pdfIn PDF document text
- http://kunovinur.littletownbakeshop.com/uploads/1/3/0/8/130813084/fad48ad.pdfIn PDF document text
- http://files.stacylhenstridge.com/uploads/1/3/0/7/130775498/07c0d6029568.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://44dd7df4-1ea6-4067-9ea8-65339505b256.filesusr.com/ugd/e50c99_20b25738beac47f7b588dc8121bb31cd.pdf?index=trueIn PDF document text
- https://1dae26e2-28fa-4bec-a096-3640b4410e4b.filesusr.com/ugd/81cd61_9cb064e8864840afac18df89cd5fc2d6.pdf?index=trueIn PDF document text
- https://3942f62c-4757-4925-a1f9-67998b0be31a.filesusr.com/ugd/ad2ade_404a0649ee084f26a69dd566cec87cc1.pdf?index=trueIn PDF document text
- https://0887978e-304d-42d0-ac79-4d588e421016.filesusr.com/ugd/8ce377_dc646ea3fcd94805aa45ced65d983f4a.pdf?index=trueIn PDF document text
- https://92d9fccc-4770-4950-8b6a-c24b45db9fba.filesusr.com/ugd/44b221_3d6c33dd3af2453fb013730878ca5c3f.pdf?index=trueIn PDF document text
- https://fa2f476b-4bef-4def-8dfa-c71287b37b52.filesusr.com/ugd/ea2f88_0fcd2eab94c94d0c9224bace056f8302.pdf?index=trueIn PDF document text
- https://6754cec4-146b-4d6e-87f4-2efaa4ba9e29.filesusr.com/ugd/d8966e_e3b3b7fe3e2045deb7bf9273ef46d56c.pdf?index=trueIn PDF document text
- https://a2e7039b-d664-4ee7-82f9-ec42d6568ee6.filesusr.com/ugd/610d21_a3cb7845a3a44850b0a9d1d816aa8e55.pdf?index=trueIn PDF document text
- https://b1965cd0-4582-4a9a-902d-dafe41bcb1cd.filesusr.com/ugd/162fe6_c54213b403374034b85d8eb04dd29f9f.pdf?index=trueIn PDF document text
- https://6e617479-aa35-4bb9-b050-b53a6793b774.filesusr.com/ugd/f6a907_7efe06f8de814456b669c478d57a5df9.pdf?index=trueIn PDF document text
- https://404dd6fb-cb42-428a-bdec-a2451c6d8ac7.filesusr.com/ugd/d43733_e1a55025e298472cba8fd525a5205ecd.pdf?index=trueIn PDF document text
- https://2c206d8a-8a6c-4796-8404-4ba8623fce83.filesusr.com/ugd/9058e5_043ca1bd6c4b40bf80b829442f8e441a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006105.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6105 | 5672 bytes |
SHA-256: 9d1e958818e02d3fefe8b0f13271e1622fda187ffea82a72c0cc15af68ef673e |
|||
font_01_sfnt_off0000743d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x743D | 9784 bytes |
SHA-256: 90d9b400300fb7357b8012c8f6f653bd7f9f4fc7617805eadfe89ffb32b5cde0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.