MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document contains a large number of embedded links, many of which point to known malicious redirectors or link farms. The document body, though heavily obfuscated, contains a URL that is also present in the heuristics as a malicious redirector. This suggests the primary purpose is to direct users to malicious infrastructure, likely for further exploitation or phishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/aws?keyword=conair+foot+spa+how+to+use
- https://tegugozitofo.weebly.com/uploads/1/3/0/8/130874592/xowegejo-boxunulusilelig-liwogizowo.pdf
- https://siveruvamavekug.weebly.com/uploads/1/3/4/2/134266289/4427893.pdf
- https://cdn-cms.f-static.net/uploads/4392451/normal_5f967dc0d0fc9.pdf
- https://luwobidope.weebly.com/uploads/1/3/0/8/130814225/navafiki.pdf
- https://juragubiv.weebly.com/uploads/1/3/0/8/130874328/f895c9.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/358210d4ddf3.pdf
- https://jijalasigode.weebly.com/uploads/1/3/4/3/134344414/lijewexajojixaz_votevajage.pdf
- https://cdn-cms.f-static.net/uploads/4368503/normal_5f8782f4982e1.pdf
- https://mipirizu.weebly.com/uploads/1/3/2/6/132682564/pinumupoduzov.pdf
- https://cdn-cms.f-static.net/uploads/4403674/normal_5f92689f5cd04.pdf
- https://xasuvakem.weebly.com/uploads/1/3/4/4/134400919/fanixawijutojifezo.pdf
- https://cdn-cms.f-static.net/uploads/4393911/normal_5f959ae18495b.pdf
- https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/1e1d71.pdf
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/2120396.pdf
- https://cdn-cms.f-static.net/uploads/4367947/normal_5f9533c4636f4.pdf
- https://samomalekadoj.weebly.com/uploads/1/3/1/4/131438786/kilomagome.pdf
- https://kufesolujuxubi.weebly.com/uploads/1/3/4/3/134373324/juzune_dikejekiriliba.pdf
- https://xigodawi.weebly.com/uploads/1/3/4/4/134464905/goganopurad_vipiveruwizaba_kedibexir_xezumapule.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0481/4972/5335/files/8648924301.pdf
- https://cdn.shopify.com/s/files/1/0500/9519/4273/files/phone_keypad_apps_for_android.pdf
- https://cdn.shopify.com/s/files/1/0429/1883/8435/files/the_guide_chapter_summary_13.pdf
- https://cdn.shopify.com/s/files/1/0485/2468/9563/files/6740779515.pdf
- https://s3.amazonaws.com/sezutuma/interval_notation_practice_worksheet_with_answers.pdf
- https://s3.amazonaws.com/tadovu/delegation_of_financial_power_1978.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000796a.bin22b397b2e0ef02ff1a5567d5b3bbc255d187033cff562e489c857b1dc551e57d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x796A | 4956 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.