MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains embedded links that redirect to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains a URL that appears to be a lure for "Quickbooks 2016 missing manual". The PDF_SEO_LINK_FARM heuristic suggests a large number of outbound links, likely for SEO manipulation or to host further malicious content. The ML classifier also strongly indicates maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/123?keyword=quickbooks+2016+missing+manual
- https://sipasegeremiraf.weebly.com/uploads/1/3/4/4/134404187/wilomi.pdf
- https://pesulomerusetus.weebly.com/uploads/1/3/4/1/134109359/5816b.pdf
- https://pabeliribid.weebly.com/uploads/1/3/4/3/134384766/1903348.pdf
- https://givexikiduxa.weebly.com/uploads/1/3/1/3/131398224/nivojo_dasesiginisowob.pdf
- https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/nolukida-wewiwasuf-kebori-dejev.pdf
- https://misutinulil.weebly.com/uploads/1/3/1/4/131407711/6937295.pdf
- https://worozimovazez.weebly.com/uploads/1/3/1/4/131406108/ripuxozidajalixovon.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/6599fde4-6a78-430a-ac10-717c8733986a/7697409228.pdf
- https://uploads.strikinglycdn.com/files/f34c3356-8d27-482e-8d42-30acc6236392/2860142483.pdf
- https://cdn.shopify.com/s/files/1/0500/0370/6006/files/39818997588.pdf
- https://uploads.strikinglycdn.com/files/f1dedb24-f837-45b4-9a9b-a08f9a189866/fubataxiwazufadiwobufug.pdf
- https://uploads.strikinglycdn.com/files/af22070c-86dd-417e-84f2-2d950e616759/muxedib.pdf
- https://cdn.shopify.com/s/files/1/0481/6827/2039/files/87742381080.pdf
- https://uploads.strikinglycdn.com/files/abcc2133-23b0-4852-a311-d5e97ec8261e/swtor_carnage_marauder_5.6_rotation.pdf
- https://uploads.strikinglycdn.com/files/e0f62326-1b46-4f96-b300-945c74bd654d/watch_lucifer_episode_2_online_free.pdf
- https://cdn.shopify.com/s/files/1/0496/5043/4211/files/zowowe.pdf
- https://uploads.strikinglycdn.com/files/f1f1b09a-43a1-471a-b5b7-0bac2c6c9358/donedapusojodeduxarunogo.pdf
- https://uploads.strikinglycdn.com/files/8a108f2e-8066-416b-b16a-65265b812bf2/rewumavasuvadena.pdf
- https://uploads.strikinglycdn.com/files/ec466f06-6835-455b-a156-fea217d63d94/50570943769.pdf
- https://uploads.strikinglycdn.com/files/e9314bee-a54c-4f86-ac5f-c9547f0fcb43/gadusurep.pdf
- https://uploads.strikinglycdn.com/files/3dd78ead-6846-49f4-96ad-615963e9e9d6/84933375405.pdf
- https://uploads.strikinglycdn.com/files/6c90bbcc-28bf-4742-a5f9-72d8a5e3b271/8826168434.pdf
- https://uploads.strikinglycdn.com/files/fbbbd69f-b98c-4065-97db-17c84b9c6305/dafikepujalujujuxiganu.pdf
- https://uploads.strikinglycdn.com/files/fff46dce-30ec-4f4b-977f-bd3cac8cce6b/xopomexiridixowoga.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b061.binf9ba923e422d2df331ffff31fb76346ce814e235bbe855cfa7dea8db3eea9cd2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB061 | 5768 bytes |
font_01_sfnt_off0000c400.bin8a6c94ac37ff64696afbb826be47c65eca4b3636364432e1f9ee5da3e61b9daf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC400 | 11044 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.