MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains numerous embedded links, with a critical heuristic identifying a link to a known malicious redirector. The ML classifier also strongly flagged this PDF as malicious. The primary malicious IOC is the redirector URL, which is likely used to funnel users to a malicious site. The document body, though heavily obfuscated, contains the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=la+biblia+desenterrada+pdf
- https://static.usrfiles.com/ugd/b8c837_90f3194e6bc64949924889cee6bf18be.pdf
- https://static.usrfiles.com/ugd/b8c837_fcbed99362e3420ea838c0c4bbed583e.pdf
- https://static.usrfiles.com/ugd/b8c837_54b90e902b8b4aa9ade104185c577f00.pdf
- https://static.usrfiles.com/ugd/b8c837_335e42b09e474ea6aae944e6a41eac6f.pdf
- https://static.usrfiles.com/ugd/b8c837_25d91c7bdb5b46f9a90f6ebb338b124c.pdf
- https://static.usrfiles.com/ugd/b8c837_bbb0d3a6468c4f348c6ca5ee6f45e002.pdf
- https://static.usrfiles.com/ugd/b8c837_351a181d98fa4a3eb7301eebd9f2f107.pdf
- https://static.usrfiles.com/ugd/b8c837_0c93cdf559994137aac924232026cf28.pdf
- https://static.usrfiles.com/ugd/b8c837_a7c462d476e04256a53a9cc320975875.pdf
- https://static.usrfiles.com/ugd/b8c837_086d752e20924578be7c702e81248317.pdf
- https://static.usrfiles.com/ugd/b8c837_32e17859efe84569b320a1a9966ec6cb.pdf
- https://static.usrfiles.com/ugd/b8c837_ce9fe9742dad456c8961b1dc3fe4173d.pdf
- https://cdn.shopify.com/s/files/1/0433/3663/0422/files/romeo_and_juliet_final_test_review_answers.pdf
- https://cdn.shopify.com/s/files/1/0436/9019/7145/files/7778974777.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000138b4.bin821e4a6c685f42a01af1bcbbaf5d06afc15206e7ed3ae33364c328daa4516042 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x138B4 | 4792 bytes |
font_01_sfnt_off000148f3.bincf55a0d40fc5d46ac94666767d4d19f35d7aeb00e744a3b02dd280a79bae9baf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x148F3 | 11460 bytes |
font_02_sfnt_off00016e48.bin05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16E48 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.