MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of embedded links, many of which point to benign Shopify URLs, but one critical link directs to a known malicious redirector. The document body, though heavily obfuscated, contains the same malicious URL, suggesting an attempt to lure users to a potentially harmful site. The presence of numerous links, including the malicious one, indicates a link farm or redirection strategy, likely to obscure the final malicious destination.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/pify?keyword=rpp+keanekaragaman+hayati+kurikulum+2020+pdf In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0479/6553/6412/files/93910445420.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8530/9103/files/3895820321.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/3871/9131/files/90105012753.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0505/1380/5512/files/venevelifilavebuxez.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/7125/0333/files/ludepevijeki.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48208121-9d64-4b28-8c42-098cc656d7d0/dimupejaxapatekolo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5dac14d0-286c-476a-96d0-219443c6d135/52330008080.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8c112b6-c108-4dac-aec4-33103383a684/13174902412.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af624655-1fff-42cc-88b1-de065552efb7/kaxopesukazoleja.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/824a86a4-7ccb-46f1-9e9d-e3e76328272c/funotuj.pdfIn PDF document text
- https://s3.amazonaws.com/jumedemimo/17822876975.pdfIn PDF document text
- https://s3.amazonaws.com/purawuma/battery_charger_circuit_using_scr.pdfIn PDF document text
- https://s3.amazonaws.com/kakef/ipad_markup_apple_pencil.pdfIn PDF document text
- https://s3.amazonaws.com/fapaga/zokemirinovebinuranixapop.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/1632/9672/files/75872896215.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/8380/7902/files/dd_goblin_race.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/4598/9783/files/23866083138.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/2742/9536/files/xunuxofanaparenugawevaf.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0504/9453/7898/files/foucault_discipline_and_punishment.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/3144/4128/files/86469647494.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/3071/5288/files/check_saved_passwords_on_android.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/6052/6756/files/kafexunap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/040bb344-4dae-4081-8668-2bdf403164d8/mukerilunuxuvovorutulijar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93737bb6-ba08-4a08-9a43-18edca25d021/51771095146.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/425e82f3-6214-4cef-9728-e4f828361b53/monty_python_always_look_on_the_brig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a4672f89-36be-426a-b928-5a70d9019ac8/nijajipabi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008e28.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E28 | 5724 bytes |
SHA-256: 51ec29fd54354d4e98ee12b5afe910ab5bae12726ca57a41d29596f86bb31d38 |
|||
font_01_sfnt_off0000a191.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA191 | 11140 bytes |
SHA-256: aec5a1e2ad86ef9c3216086d86b42a0767e97e0bc3354b6c05dd30ce749b83bc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.