MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a significant number of embedded links, with heuristics indicating a 'PDF SEO Link Farm' and a 'PDF Malicious Redirector Link'. The primary URL identified is 'https://ttraff.club/wix?keyword=nyc+community+schools', which is flagged as a malicious redirector. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, which aligns with the link farm heuristic.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=nyc+community+schools
- http://files.tuffprotect.com/uploads/1/3/1/3/131379510/bibokepozumife.pdf
- http://zalibo.der-atemraum.com/uploads/1/3/1/8/131871761/d7220132fa.pdf
- http://tikafevol.nbpeipublichealth.ca/uploads/1/3/1/3/131398102/wetiwodokifowi_xezaru_vozosapelikuna.pdf
- http://xezetu.cornellgrouplab.org/uploads/1/3/1/6/131606343/656211209015f8.pdf
- http://files.doorsintime.com/uploads/1/3/1/4/131408465/mijegigoxoxazevadi.pdf
- https://cdn.shopify.com/s/files/1/0476/8219/1526/files/aahat_2019_mp4.pdf
- https://cdn.shopify.com/s/files/1/0433/1244/7652/files/aguacate_hass_en_mexico.pdf
- https://856ef838-8c3f-43e7-8f1d-482eac16a36c.filesusr.com/ugd/b916f4_dbc371345d874b8ab02b8bebaa815718.pdf?index=true
- https://7f29e22a-1224-4539-b73d-8d73988f7150.filesusr.com/ugd/f5a024_b6af5241c776471890ae0fe391568083.pdf?index=true
- https://0e26175e-70c9-4ea5-9f32-64e9f77fafd5.filesusr.com/ugd/3be48b_963d7ad2d4934ec38f647bed5e83a49f.pdf?index=true
- https://1a34ff91-9623-4d58-9010-f171557fcb71.filesusr.com/ugd/6cf392_89c62c583f2748f3a2218b5627226a4e.pdf?index=true
- https://84797109-9b1b-4a79-a12d-8b0d3141429a.filesusr.com/ugd/69b86f_9f0444b7651f4b9c93840f44c1018632.pdf?index=true
- https://cdn.shopify.com/s/files/1/0438/4466/5506/files/dadikiwedarazimolawo.pdf
- https://cdn.shopify.com/s/files/1/0440/2393/9237/files/generate_allure_report_from_xml.pdf
- https://cdn.shopify.com/s/files/1/0435/5692/9687/files/wusejuvaxuvijulok.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006767.bin47eb22eabf983a98edf1de251044e89d90c19c13f8d50056d7803821a0ce2486 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6767 | 4804 bytes |
font_01_sfnt_off000077b0.bina20f18c82c27a5529132bd63da9e11b3844cf5a60fa51bb335f0b853f59cd1a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77B0 | 10096 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.