MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF document flagged by multiple heuristics as malicious, including a critical alert for a redirector link to known malicious infrastructure. The document body, though heavily obfuscated, contains a URL that matches the redirector link found in the heuristics. The presence of advance-fee scam language further supports the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=autonomous+driving+system+pdf
- http://files.coloradopricklypawshedgehogs.com/uploads/1/3/1/8/131871690/3ff0e3f4.pdf
- http://files.shs-spartans.com/uploads/1/3/1/3/131384777/8823291.pdf
- http://files.helpgmsrlss.com/uploads/1/3/1/3/131383949/6566707.pdf
- http://files.mindfulkidsla.com/uploads/1/3/0/7/130776619/nunemefit.pdf
- http://files.molarcubed.com/uploads/1/3/1/4/131406800/perakuwox-gabulag-tojoxafepur-mejuposub.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0430/9411/4453/files/sql_server_2020_management_studio_express_tutorial.pdf
- https://cdn.shopify.com/s/files/1/0430/2834/9079/files/canon_eos_rebel_k2.pdf
- https://cdn.shopify.com/s/files/1/0438/2185/8973/files/lavunapa.pdf
- https://cdn.shopify.com/s/files/1/0434/8923/1014/files/xegifexozusavi.pdf
- https://cdn.shopify.com/s/files/1/0431/5653/7505/files/filosofia_aristotelica.pdf
- https://cdn.shopify.com/s/files/1/0431/7508/4193/files/rifolujoxowiwuzugijofalek.pdf
- https://cdn.shopify.com/s/files/1/0439/0502/4168/files/7683482272.pdf
- https://cdn.shopify.com/s/files/1/0428/0002/1667/files/feguzagudu.pdf
- https://cdn.shopify.com/s/files/1/0431/6351/7092/files/bimobemaxubumebodolupo.pdf
- https://cdn.shopify.com/s/files/1/0428/7548/6367/files/zazanozutexenofedefofefe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002782a.bin601b99a36a74e3fb267da38a3ca3ee7848eb0fd1fdaef4aba2bb5cacb54b80c3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2782A | 5268 bytes |
font_01_sfnt_off00028a13.bin1a22ecb6d5dbe567e01d0a2fb6134ba15df7de3ffb4aefd7ac54cdba133c1be3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x28A13 | 11180 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.