MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file exhibits characteristics of a malicious redirector and SEO link farm, as indicated by multiple critical heuristic firings. It contains numerous embedded URLs, with at least one pointing to a known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector. The primary attack pattern involves luring users to click on these links, which likely leads to further malicious content or exploits.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=coarsely+comic+crossword+clue
- http://besizobaf.sciencedee.com/uploads/1/3/1/4/131438641/f32df46cfb3add.pdf
- http://gebigojap.annapike.co.uk/uploads/1/3/0/8/130874482/7d43792934f7.pdf
- http://files.ballstatepsychsciencema.us/uploads/1/3/2/3/132303320/zufored-lovewuk-pumoti-zexibivibodil.pdf
- http://kozewazer.ice-fyre.ca/uploads/1/3/2/8/132814930/5978905.pdf
- https://cdn.shopify.com/s/files/1/0446/8791/7209/files/accounts_payable_interview_questions_and_answers_download.pdf
- https://cdn.shopify.com/s/files/1/0437/6985/6158/files/bike_crash_meme_template.pdf
- https://cdn.shopify.com/s/files/1/0458/5953/7049/files/bundle_size_android.pdf
- https://cdn.shopify.com/s/files/1/0459/9844/0605/files/64677205879.pdf
- https://cdn.shopify.com/s/files/1/0446/1314/0643/files/vibrations_and_waves_george_c_king.pdf
- https://2ef7debd-ffb8-442a-849d-5e3471a8fcb9.filesusr.com/ugd/3aca14_c38bff062f484e7b8ed804bd777b903b.pdf?index=true
- https://628b4481-851f-4f4b-a475-94c9020fd17e.filesusr.com/ugd/dad90e_eb42bd8c71b84384b8a61e0574a6d176.pdf?index=true
- https://920fd11a-8485-49e0-9c4d-22bd42718aba.filesusr.com/ugd/1a1092_07b244593bf54d259e6374081eee34cd.pdf?index=true
- https://4326930e-022b-468b-b137-983f9499a56b.filesusr.com/ugd/33ab24_46db40b81b0e426690cae40ecd3c3878.pdf?index=true
- https://cdn.shopify.com/s/files/1/0435/8848/5288/files/51932740765.pdf
- https://cdn.shopify.com/s/files/1/0434/0255/9655/files/d_d_5e_tomb_of_annihilation_free_download.pdf
- https://cdn.shopify.com/s/files/1/0427/9926/8003/files/68737267061.pdf
- https://cdn.shopify.com/s/files/1/0445/3564/4319/files/bobina_de_tesla_principios_fisicos.pdf
- https://cdn.shopify.com/s/files/1/0437/5497/9477/files/kukorin.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000053e2.binb689a214af561141e6053d4264ead9d5b7031eb0c73a9b34925b8887495cd4b7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x53E2 | 5184 bytes |
font_01_sfnt_off00006583.bine965f93b1eca0ef934168df25505bea515e23c9a1faef22d379dfcd47320fff6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6583 | 10088 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.