MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged as malicious due to a critical heuristic identifying it as a redirector link to known malicious infrastructure. It also contains a large number of external PDF links, characteristic of a link farm. The primary malicious IOC is the redirector URL, which likely serves as the entry point for further malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=getting+started+with+matlab+rudra+pratap
- https://cdn.shopify.com/s/files/1/0435/5981/3279/files/5819496134.pdf
- https://cdn.shopify.com/s/files/1/0435/5892/8545/files/contoh_media_audio_visual.pdf
- https://cdn.shopify.com/s/files/1/0430/6341/0845/files/anthem_by_ayn_rand_download.pdf
- https://cdn.shopify.com/s/files/1/0468/9677/5330/files/81781300257.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/befuxaj.pdf
- https://static.usrfiles.com/ugd/b8c837_6e04b37cf8234c69b4a55d7882f1f717.pdf
- https://static.usrfiles.com/ugd/b98abb_b451de2fbcef4234aea51e130e49192c.pdf
- https://static.usrfiles.com/ugd/191a6d_d2745e38ae4d4e4e946346061b7b1954.pdf
- https://static.usrfiles.com/ugd/b8c837_1efa1e563b4d463590492b88544a8ace.pdf
- https://static.usrfiles.com/ugd/b8c837_d01a7cd95c214d478b765003b0f36d62.pdf
- https://cdn.shopify.com/s/files/1/0432/1663/4016/files/pedotogunufezene.pdf
- https://cdn.shopify.com/s/files/1/0427/4126/8647/files/pegegunodelisufuwigudegu.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/89647405972.pdf
- https://cdn.shopify.com/s/files/1/0431/3382/9271/files/benton_sans_book_font.pdf
- https://cdn.shopify.com/s/files/1/0448/1577/7954/files/a_level_physics_mcqs.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/24221046066.pdf
- https://cdn.shopify.com/s/files/1/0432/2931/5229/files/xemonifikesuzofebi.pdf
- https://cdn.shopify.com/s/files/1/0444/8839/2871/files/pharmacy_personal_statement.pdf
- https://cdn.shopify.com/s/files/1/0447/8743/3623/files/1398702561.pdf
- https://cdn.shopify.com/s/files/1/0438/2218/6656/files/bernoulli_differential_equation_solved_problems.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000050a5.bin437f8625faca5827ef682c3a582bb23d8479d8ce5012abaacf03ae2bddabf273 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x50A5 | 5636 bytes |
font_01_sfnt_off000063af.bin24306d54b8f20b3648e32173d80c88af948251a48d91357e50e71ededcdf4f08 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x63AF | 9616 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.