MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though partially obfuscated, includes the same malicious URL, suggesting an attempt to trick users into visiting a potentially harmful site. The ML classifier strongly indicated maliciousness, and the presence of a link farm further supports a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/strik?keyword=watch+desperate+housewives+season+3+episode+10 In PDF document text
- https://cdn-cms.f-static.net/uploads/4374366/normal_5f8f4f40aaa17.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385216/normal_5f97f90b14069.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409093/normal_5f972e5347c21.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404116/normal_5f948583dd34d.pdfIn PDF document text
- https://renesixedobalew.weebly.com/uploads/1/3/0/9/130969137/286701f79e.pdfIn PDF document text
- https://sevivuninuk.weebly.com/uploads/1/3/4/4/134459749/5163987.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384645/normal_5f8ed03dea7d8.pdfIn PDF document text
- https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/zebemub-rolalupewevuti-lolulazilafu-gotikuz.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/aae397f2-9085-4a98-9627-f0077c74d884/71621711363.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/4750/8385/files/tuvazajulogenojinijusiwum.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/0186/2073/files/nuripajitazobeleg.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a003125-e564-4c95-9431-b5e18cd382b1/39211748738.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/08db98e5-ec33-417f-a500-721d62767b18/gitugafisoji.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/9612/2561/files/33454702774.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e03a183e-36b3-4e04-97ad-4642a40a67a4/an_introduction_to_language_10th_edi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b16553cb-266a-4381-bc3c-46d6c4b61367/xixogobodewajapalofizexu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf56ab4a-a82d-4be8-babb-ebd57eae387c/kibewukekowaweravon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac2837c4-b6f7-471f-8fb1-d3a5c02da4a4/44011961742.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a650a5b6-7729-4b9c-90de-bc2394dcc589/vox_ac4tv_schematic.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd664bbc-6c1c-426e-aced-90f7159d1808/personality_disorder_questionnaire.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f0b31e08-d9fc-437e-9f0f-08b09b93e22f/como_se_truenan_las_anginas.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8714/4109/files/tudoxorag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/27ff0cee-6ac7-4049-9498-371ab032f692/67902647718.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8aee4f81-58af-4633-9e58-138c15f9b5d3/boletebomemi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000078d9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x78D9 | 5652 bytes |
SHA-256: 7f3e83af419f1ef9cec82c17deaee2e2e78d39c4d38192dd156b3baee79ac748 |
|||
font_01_sfnt_off00008c31.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8C31 | 11272 bytes |
SHA-256: 58bd894d183fd28d1782215d5e56fb5b8c836b845bfbeea36a60d74f9b4c1775 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.