MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a high number of external links, many of which point to a redirector service. The primary malicious link, 'https://ttraff.cc/pify?keyword=enterprise+blockchain+platform+comparison', is designed to lure users into clicking by appearing to offer a comparison of blockchain platforms. The ML classifier strongly indicates maliciousness, and the PDF structure suggests a link farm for SEO manipulation or malicious redirection.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=enterprise+blockchain+platform+comparison
- http://gasafovan.mrscroninphysicalscience.com/uploads/1/3/0/7/130776167/1843a67.pdf
- http://xopex.debbiewhitelcsw.com/uploads/1/3/1/0/131069934/dbb107ca5.pdf
- http://files.temeculavalleyvegansociety.com/uploads/1/3/1/8/131856039/kuzinunumi.pdf
- http://files.acestudio.be/uploads/1/3/1/3/131383964/gipasixojejat.pdf
- http://dozak.ctlawsearch.com/uploads/1/3/1/4/131453494/2676893.pdf
- https://cdn.shopify.com/s/files/1/0427/9838/3260/files/cutting_edge_pre_intermediate_workbook.pdf
- https://cdn.shopify.com/s/files/1/0441/0068/1880/files/grade_7_mathematics_practice_test.pdf
- https://cdn.shopify.com/s/files/1/0434/7274/8709/files/5254712246.pdf
- https://cdn.shopify.com/s/files/1/0438/5649/4757/files/36218188529.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/totavari.pdf
- https://cdn.shopify.com/s/files/1/0449/7778/2952/files/medical_laboratory_technology_notes.pdf
- https://cdn.shopify.com/s/files/1/0428/6090/4615/files/44430627836.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/ferenap.pdf
- https://cdn.shopify.com/s/files/1/0429/4233/3084/files/gasuxebajemeputuwo.pdf
- https://cdn.shopify.com/s/files/1/0435/9307/2808/files/48531292963.pdf
- https://cdn.shopify.com/s/files/1/0430/7002/9975/files/84695276532.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/vofekofunore.pdf
- https://cdn.shopify.com/s/files/1/0431/8671/6830/files/domain_name_system_in_computer_networks.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011ef5.bined6b46596b636b2f91685c769c9e3decc16ec0d7e0c87c52ad08e684ba7a78c7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11EF5 | 5416 bytes |
font_01_sfnt_off00013130.bin9b1389150e12faefc1d246360509c23acc4954a27d0190e0f9db1f9f54ee6569 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13130 | 11080 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.