MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded links, many pointing to shopify.com domains hosting other PDFs, and one critical link to a known malicious redirector at ttraff.com. This suggests a link farm or redirection strategy to obscure the ultimate malicious destination. The ML classifier strongly supports the malicious verdict. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=blank+sheet+of+paper+app
- http://files.theoptometrygroup.net/uploads/1/3/2/3/132303219/nokagidu.pdf
- http://jivofuxu.kappagammachi.com/uploads/1/3/1/8/131856726/60e6dac8754.pdf
- http://files.anglersarsenaltx.com/uploads/1/3/1/8/131871725/9375144.pdf
- http://files.kailaskomfort.org/uploads/1/3/0/7/130775727/wetedixuxuxexig.pdf
- http://files.proyecto1867.com/uploads/1/3/1/4/131452870/najokebilaluxe.pdf
- https://cdn.shopify.com/s/files/1/0429/6169/8969/files/tenukunelataludowur.pdf
- https://cdn.shopify.com/s/files/1/0433/2204/8667/files/bufizubomowitikesuni.pdf
- https://cdn.shopify.com/s/files/1/0435/7708/2017/files/national_lottery_scratchcards_claim_form.pdf
- https://cdn.shopify.com/s/files/1/0430/3699/9842/files/recuva_full_version.pdf
- https://cdn.shopify.com/s/files/1/0440/2397/2005/files/calculus_early_transcendental_functions_larson_6th_edition.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/12091312038.pdf
- https://cdn.shopify.com/s/files/1/0437/7542/6722/files/75298410966.pdf
- https://cdn.shopify.com/s/files/1/0437/3181/2504/files/nililuzagifibewivumeseke.pdf
- https://cdn.shopify.com/s/files/1/0438/0521/2832/files/define_cavernous_malformation.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000049df.binfb2948cd82ee9e21e92b184d2602bfd31c1d8a5ee934155d56ac5ceecb72d2f4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x49DF | 6648 bytes |
font_01_sfnt_off00005a57.bince46b03bac22acb8bba32a1ed4e6edff2a7b3e22ad8a6d70c645fcb63db60141 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5A57 | 5104 bytes |
font_02_sfnt_off00006bac.bind7fb7a0f032c8f4d39c87b41789eeff3d9dc9bf936af5bc476203f65627a6ec3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6BAC | 9464 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.