MALICIOUS
270
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
T1059.007 JavaScript
This PDF document contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though obfuscated, contains text referencing 'Telecharger arpspoof apk' and includes URLs that suggest a lure for downloading potentially malicious software. The presence of remote support and download button lures further indicates an attempt to trick the user into executing a payload.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 9
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Remote-support tool lure high SE_REMOTE_SUPPORT_LUREDocument instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=telecharger+arpspoof+apk
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cd1365ec-69e6-40f6-8e0b-77edfe990908.filesusr.com/ugd/2eedf1_52e4f8fb0aad482ca869fdd7c8adb1c0.pdf?index=true
- https://870698a2-4e05-4e86-8d14-2b7790669147.filesusr.com/ugd/3eb4bd_ef55e3d0260145a0b4abba627c9130d3.pdf?index=true
- https://9c1f36d2-cef9-47e1-b2b6-9bcf316fec05.filesusr.com/ugd/409ca8_8c437adc555e468cbc8be5243bd0fc39.pdf?index=true
- https://5d38441d-bbba-40ac-99a4-592b6bf23bd8.filesusr.com/ugd/92ee2b_dbb4d284c2fd40f781ba8540254470fe.pdf?index=true
- https://e0d04271-313c-4ee9-8581-bc499244d56b.filesusr.com/ugd/7be1cd_d6a6083966ef4c779b1e80f998737296.pdf?index=true
- https://cdn.shopify.com/s/files/1/0440/5759/1960/files/20701612710.pdf
- https://cdn.shopify.com/s/files/1/0429/4138/2812/files/fibibebosijasanepepa.pdf
- https://cdn.shopify.com/s/files/1/0457/0772/2908/files/51587743745.pdf
- https://cdn.shopify.com/s/files/1/0432/2541/5843/files/curl_request_body.pdf
- https://cdn.shopify.com/s/files/1/0432/0182/2875/files/91653508297.pdf
- https://cdn.shopify.com/s/files/1/0435/7062/6723/files/unicode_fonts_for_windows_10.pdf
- https://cdn.shopify.com/s/files/1/0427/6636/8935/files/3529978560.pdf
- https://cdn.shopify.com/s/files/1/0432/5307/2022/files/jirijerukanaxo.pdf
- https://17a20cdd-505f-45ab-8c28-5069b50b7907.filesusr.com/ugd/cc089a_54529ec32ddc42849339d80854cd5b38.pdf?index=true
- https://6480b124-ee05-4186-bbd9-c2117cf1a3e7.filesusr.com/ugd/c5d40f_1c05af0a22cc4c43a272cec00f216b40.pdf?index=true
- https://edc2e905-68f0-4a8f-8a8b-e5d893f618cb.filesusr.com/ugd/173616_163125a9a8a944ff9f9863b360e73e30.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0432
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001237d.bin84617f5abb7d13a33b41ea389a86a3cf71d8ea8201c42161ca61b89543ef50b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1237D | 5292 bytes |
font_01_sfnt_off00013577.binf3a72364cc33bba51a2c34c2eb9c880405fdee23d2d2e505b4b7a57b42a24ac3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13577 | 11416 bytes |
font_02_sfnt_off00015c31.bin3ca5fa257607d3b0d7a4ca164d91b6e42bee773add32b64d8670b53183a5f5cd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15C31 | 16508 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.