MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple embedded links, with a critical heuristic firing for a malicious redirector. The document body, though partially garbled, includes text suggesting a 'consent order template family court' lure, which is likely a pretext for phishing. The primary malicious URL identified is a redirector that leads to further malicious content, potentially a phishing page or malware download.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=consent+order+template+family+court In PDF document text
- http://fikesoz.absterpokemonshop.com/uploads/1/3/0/8/130814020/xevibesu.pdfIn PDF document text
- http://dugum.bamboogrove.net.au/uploads/1/3/1/8/131856161/41de3d.pdfIn PDF document text
- http://guxaxeb.maestrodonappert.com/uploads/1/3/2/3/132303354/kajakozokezan.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0430/3680/3233/files/82886440145.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/3320/6690/files/18295146402.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/0722/1661/files/wpf_listbox_item_data_template.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/5339/1780/files/risperdal_consta_package_insert.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/2698/7680/files/cahier_de_texte_prof__imprimer.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/2857/8467/files/northwest_territory_tents.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/1540/4695/files/sabufurobobusatovo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/0979/4463/files/folawowomole.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/9286/0327/files/aprendizaje_cooperativo_en_las_aulas_juan_carlos_torrego.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000601a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x601A | 5096 bytes |
SHA-256: 12ef17beaf1bb04d4176594489a3e11dd2509b657250f3113307e43e19453c9a |
|||
font_01_sfnt_off00007201.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7201 | 5308 bytes |
SHA-256: a2902cfb40d28ea92de331466c5efd1696bc24bf203c20c8bbc9427a59c9121b |
|||
font_02_sfnt_off000083fa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x83FA | 10564 bytes |
SHA-256: f924660b79262644daac8aaed6046393756679050119d7383c40544c51160406 |
|||
font_03_sfnt_off0000a754.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA754 | 16684 bytes |
SHA-256: fe1ca6a691315ef32827512bb86cd3188d7c30cfa02bd4559714794831c9b14a |
|||
font_04_sfnt_off0000be70.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBE70 | 4324 bytes |
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.