MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document contains a large number of embedded links, identified as a link farm, directing users to potentially malicious websites. The primary malicious URL observed is https://cctraff.ru/aws?keyword=three+main+types+of+public+policy, which is flagged as a redirector. The document's content, though appearing to be about public policy, is a lure to facilitate the distribution of further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/aws?keyword=three+main+types+of+public+policy In PDF document text
- https://jorimedazaget.weebly.com/uploads/1/3/0/7/130738946/pomemegifaxe.pdfIn PDF document text
- https://tosisevutozu.weebly.com/uploads/1/3/4/3/134328017/fazik.pdfIn PDF document text
- https://lasunawinifomun.weebly.com/uploads/1/3/4/3/134385524/f8894b271566a0.pdfIn PDF document text
- https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/nodenodiwi_karap_pigumexapit_mepigozefodom.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d03dfd54-fd59-4280-b3e4-c4aa3d87d777/suvepiliwudosizumimubel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b2739dd-6473-4826-a5e1-40c5ad63f24f/koragebikiwaravikejasaku.pdfIn PDF document text
- https://s3.amazonaws.com/pazifetanegapu/nuderide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f740e130-e3fa-4ded-b990-f820feb2d59c/cham_cham_song_free_download_from_ma.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42e177ff-4b3c-4619-aff7-02403465c6cb/japemexagi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/488a4855-65e0-4aa1-9855-2076e75114e2/24295078265.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0483/6681/3337/files/rejadejijiwoduboniki.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57cff74e-7664-4ad5-a7e4-fea5f746c983/29342340641.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be7e1cac-8a7a-4c96-a7c6-cba292c7ca45/fapebo.pdfIn PDF document text
- https://s3.amazonaws.com/fedufiporara/64629339656.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7dce201-5999-4ccc-91cf-f28030915b99/stellaris_auto_build.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a0a2f12-dac3-4fee-a557-e6875e24f8bf/tepaki.pdfIn PDF document text
- https://s3.amazonaws.com/xefejevife/99402662328.pdfIn PDF document text
- https://s3.amazonaws.com/pexodugosa/present_continuous_affirmative_negative_interrogative.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5d1a251-009d-4c71-8f82-9cd61a1b67a6/91028759095.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0483/9833/6160/files/xofigopopikavebagutaxad.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10cc26e2-9dfa-4571-b35d-ecfb81d391d7/59260499648.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e50d2424-0760-43b8-b8e8-981b07c97ce8/20665784739.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/633087ab-4645-4bd2-84ff-5adbc8205ce0/4326374202.pdfIn PDF document text
- https://s3.amazonaws.com/xisefowu/lm317_voltage_regulator_circuit.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008cad.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8CAD | 5444 bytes |
SHA-256: 5ba9bb8784c7a99a2a7e38d2bc47b6be08483531d47733e69d27899f2e407ced |
|||
font_01_sfnt_off00009f0b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9F0B | 10444 bytes |
SHA-256: 21d845e042e5db98eecdc74f2742f27fdda5e99fefe073afb73408cef8b35b88 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.