MALICIOUS
74
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains an embedded URL that redirects to a suspicious domain, identified as a potential SEO redirector for phishing or malware distribution. The heuristic 'PDF_SEO_UTM_REDIRECTOR_LINK' strongly suggests this is an image lure for free downloads, a common phishing tactic. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a malicious intent to redirect the user to a compromised or malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 3
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffnew.ru/aws?keyword=hobo+games+5 PDF link annotation
- https://sarutofujatazix.weebly.com/uploads/1/3/4/5/134584212/lepuzijiled-domapuge.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370533/normal_5f8fd7b7cd2ae.pdfIn PDF document text
- https://vigaziwow.weebly.com/uploads/1/3/4/3/134322068/4efaa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375087/normal_5f980e83d4d84.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425227/normal_5f9d77518ae6e.pdfIn PDF document text
- https://zigegawemofeza.weebly.com/uploads/1/3/1/4/131406932/situb_somexilotewinef_wununadi.pdfIn PDF document text
- https://rikinosi.weebly.com/uploads/1/3/4/3/134352476/2752108.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jamokaroxoj/49682228885.pdfIn PDF document text
- https://s3.amazonaws.com/jinabom/hopkins_preschool_aberdeen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22a651cd-537f-4d69-988f-74f9385bda69/92067015552.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ffa55514-ce14-4283-99c5-15a58a4475c7/nikademorewubodowow.pdfIn PDF document text
- https://s3.amazonaws.com/juliziwojatige/shoppers_world_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/172063e0-dd44-4e6c-9a68-810275a78614/nodezobafupugunokoj.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000622f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x622F | 5104 bytes |
SHA-256: 80048c1d242144f812fa3329832c4ea34de5241f528b8a68f2fb274fd24f53fe |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.