MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a heuristic firing for linking to known malicious redirector infrastructure, specifically pointing to 'https://cctraff.ru/strik?keyword=siddhartha+full+text+pdf'. Additionally, it exhibits characteristics of a link farm, embedding numerous external PDF links, with the first being 'https://cdn.shopify.com/s/files/1/0439/3009/1688/files/grammatik_aktiv_b2-c1_cornelsen.pdf'. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/strik?keyword=siddhartha+full+text+pdf In PDF document text
- https://cdn-cms.f-static.net/uploads/4373987/normal_5f8ab04c52361.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374536/normal_5f8aea1299542.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379486/normal_5f8a4be3808c9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366010/normal_5f888850c36f4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375696/normal_5f8ae5d84187a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372354/normal_5f8a75772d6c4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379723/normal_5f8ab9ff51188.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374682/normal_5f8996fc3d760.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0439/3009/1688/files/grammatik_aktiv_b2-c1_cornelsen.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/5468/4565/files/onq_pm_system.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/0693/8266/files/20156748230.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/9105/8076/files/juvuwilupe.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/0675/4456/files/84185818131.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4174a82-ed6b-440d-8af0-033d9b4b3bbe/donufevumukodafa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a802a2f-450f-4df1-babf-5cbba0625d32/28507203320.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a8af3aef-b2d5-4474-a05f-6b1327069776/kipuzijuwevafolinanipesox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ac69433-c4a5-4e4e-9674-81dfb54714e4/tobevuvugasabemup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50333bd4-353a-41a5-b9da-b503a783d1b4/89862033055.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/2664/7709/files/77424750835.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/3838/7607/files/10630907530.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0492/3739/3564/files/zijufokikajir.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/1684/5469/files/77730645070.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/2754/1409/files/graco_signature_series_jogging_stroller_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/2242/4480/files/85864684652.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/1484/8153/files/togerojidekofowopikexet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/3081/3093/files/past_participle_in_spanish_irregulars.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008e59.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E59 | 5124 bytes |
SHA-256: 57cf2c02551f62bb3031465831a93227fa460553bfcf604db26687d6d006ddfe |
|||
font_01_sfnt_off00009fc2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9FC2 | 10360 bytes |
SHA-256: 077ef60442ea5df7d2d7746cd0a6a9bccdd0f63b1f1fcd7d52f9041c9522f1bd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.