MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded links, with one critical heuristic firing indicating it points to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be the primary lure. The presence of numerous external PDF links suggests a link farm or SEO manipulation tactic, likely to obscure the malicious redirector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/pify?keyword=goyle+harry+potter+glasses In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/0878/9150/files/reponaxosarelizitog.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0504/9076/9588/files/85817563329.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/8870/7738/files/where_is_the_nearest_super_walmart.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83c894c0-3f9f-48db-a6f2-d4238d9862ff/nusezubeniredeka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c41171d3-bf3e-4f76-a69f-67bebc59ddbb/vuescan_serial_number.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01f661a0-ac87-4690-b7d3-34f8902d84dd/72132199831.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4a74ca4-e452-49b1-9554-0971a6ff3338/12448422526.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3b76a72-6854-4930-bb84-b2edce2061bc/89416025596.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/923a268d-f473-460e-a710-a13def1a433e/22090267358.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d40e0cea-e05b-4a48-aa69-3a622a99d7f0/wozubidajetap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e94bf96-4f6b-46cf-b790-8d675b93072d/63717092965.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d4a9708-2777-4ff5-8b10-495d58389195/dihybrid_crosses_worksheet_with_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e38dd1b2-abc8-4425-8543-272069653f38/mainstays_baja_futon_sofa_sleeper_bed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83d87278-a9c6-4a5f-8759-c969f0cc06b5/sonaji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b28e77a-2891-4ed1-9663-93d05b532005/xibuwomuko.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b668c2b0-291d-4899-820a-6615c18e5fe0/dobaxibufezajexusizi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/288e7179-2021-4c70-a8f0-1dd9abd47fd7/35477809013.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6e71053d-447c-4882-812d-957a11d87b08/tibifezigutawerofifudo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89e18c04-735d-4caf-8999-fc055ef4e81d/gidokubuvojurufugesakig.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/2406/3392/files/juxin.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/8165/2155/files/mean_median_mode_range_problems.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/2907/6419/files/15173647413.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0506/5326/6070/files/simple_tenses_exercises_with_key.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000082f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x82F1 | 29708 bytes |
SHA-256: 6fc4e0b0bde509debbb12eaa22bb99dcaf4e00166bd3910b6a42ccffbb91f93a |
|||
font_01_sfnt_off0000dead.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDEAD | 5216 bytes |
SHA-256: f52b13de42f7fcf269ce407d6546ea7d2fec32b12b9de23173ea136e9b053fbe |
|||
font_02_sfnt_off0000f070.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF070 | 13516 bytes |
SHA-256: 824023c02c284f367f08bec874faf6fc2ec813a67821bef2f555bb922fa5c2e0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.