MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous links, with a critical heuristic firing for a malicious redirector URL. The document body, though heavily obfuscated, contains the same redirector URL and other benign-looking PDF links, suggesting a lure to a phishing or scam site. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=poema+de+te+quiero+mucho+mi+amor In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://2a517046-1808-413d-8297-1dd08b4e50d9.filesusr.com/ugd/7d1dc9_492420579ab740b4b65719a695ccc41d.pdf?index=trueIn PDF document text
- https://9f5ad3b4-79fc-4c62-b83b-ab833c9e9434.filesusr.com/ugd/96564c_19e261b9539c4c9da25ff1852889a0ae.pdf?index=trueIn PDF document text
- https://1d908fb7-b4d9-46af-9f8c-fe9840b95dcf.filesusr.com/ugd/ce4b7c_f444532061e142d18ce793d3c3f7036b.pdf?index=trueIn PDF document text
- https://4fe860d2-990c-49eb-b994-e077f3673e42.filesusr.com/ugd/35f767_cdb5fabeb8e44e0c9189b6df97658522.pdf?index=trueIn PDF document text
- https://ae66d90f-821f-419c-8caa-13ddf8204ce6.filesusr.com/ugd/1cc777_1f5bffac47c649538c7524aba710cb26.pdf?index=trueIn PDF document text
- https://cf224084-ad22-4eeb-a309-eade95647fee.filesusr.com/ugd/3db607_b24d225a587f4f4b98b9a98ece7d51c3.pdf?index=trueIn PDF document text
- https://7c8bfc6a-5158-4c43-a792-f6bb8122b648.filesusr.com/ugd/e50c99_e6418d7ccdd54010aeef84fd86b39645.pdf?index=trueIn PDF document text
- https://a7feac66-0005-4dd1-a8fd-faceb9269f55.filesusr.com/ugd/5f5755_076f169e5fd047ffacd2b6d8da7ae478.pdf?index=trueIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/6112/5013/files/bujumenadilidewukufosa.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/3968/5799/files/satidabekimawege.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/5652/8541/files/performance_appraisal_objectives_for_personal_assistant.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/4874/7676/files/filuwur.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/5651/3692/files/madigelurek.pdfIn PDF document text
- https://d1572b91-d079-4e52-a210-1f56706c7c95.filesusr.com/ugd/370ea2_7fa53fd11e6f4d8eafb2334cebaef351.pdf?index=trueIn PDF document text
- https://445d226a-dde1-41b3-9045-302692bb9bf6.filesusr.com/ugd/baef12_eb2f3792c56443ea81997c9a35fd6445.pdf?index=trueIn PDF document text
- https://6e488c02-77d3-4f53-afe2-46942bca33c5.filesusr.com/ugd/3f80ec_3de9dc66ce094d9eb8ea1f8c160b7dbe.pdf?index=trueIn PDF document text
- https://e583d1a6-8096-4ceb-a5ee-e813418032db.filesusr.com/ugd/de60da_793eca6e015d41e4aa973fd206a89fa9.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000653e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x653E | 5096 bytes |
SHA-256: 8b1ddf1aa1a9cf228f2519e817e9d811a34692abc62745b3920c1ae759f042d4 |
|||
font_01_sfnt_off0000765d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x765D | 10548 bytes |
SHA-256: de383b9133bb48ef36fc510ec29f487a61cea1520f805c6575f9b6492572eff2 |
|||
font_02_sfnt_off000098a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x98A5 | 16384 bytes |
SHA-256: 226a8e4e528c820945b068501793868e9b71e899c703a7ad804f9a2f424011a5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.