MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains embedded links that point to a known malicious redirector. The document body, though heavily obfuscated, appears to contain text related to a 'Raspberry pi user guide 3rd edition pdf' and the malicious URL. This suggests a social engineering attack aiming to trick users into visiting a malicious site. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=raspberry+pi+user+guide+3rd+edition+pdf
- https://static.usrfiles.com/ugd/b8c837_020fe300be4e4cbbadafe8ae2b3033d0.pdf
- https://static.usrfiles.com/ugd/b8c837_574a037abe994a8a9fa4f279587cdbb0.pdf
- https://static.usrfiles.com/ugd/b8c837_eca20d8d80864686b7b0ff98c33d8a2f.pdf
- https://static.usrfiles.com/ugd/b8c837_cbc3ed3688bd4e81b20d5ed8562a561f.pdf
- https://static.usrfiles.com/ugd/b8c837_e2a89813248842adba99f71001887dc0.pdf
- https://cdn.shopify.com/s/files/1/0430/8982/1845/files/levosipitegokosumabuz.pdf
- https://cdn.shopify.com/s/files/1/0432/2190/9662/files/fuvuj.pdf
- https://cdn.shopify.com/s/files/1/0448/9006/3003/files/jonbenet_autopsy_report.pdf
- https://static.usrfiles.com/ugd/b8c837_03b79bbc41cb40b0a2e6c983721a8b59.pdf
- https://static.usrfiles.com/ugd/b8c837_10a19c943d4f41f4bb6f82c12504653c.pdf
- https://static.usrfiles.com/ugd/b8c837_a2298079133140999817f0eb7840f75a.pdf
- https://static.usrfiles.com/ugd/b8c837_c93d21e7dd764e2ea686265d444ccb34.pdf
- https://static.usrfiles.com/ugd/b8c837_42a8662ca4ad47a9b6d185786cad8943.pdf
- https://static.usrfiles.com/ugd/b8c837_51548800da624d1c94d476640acad02f.pdf
- https://static.usrfiles.com/ugd/b8c837_5174e7def6a94be988f14b32e2cadd09.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000065b8.binb868007db334ffaab5cf1d6e59e1f798e663d2bbf1f596256dcfaa28064c0b90 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x65B8 | 5592 bytes |
font_01_sfnt_off000078db.bin117c23a43121685b5e9c050ce11049e073903ed5539647b91cfc3f89f0a4697a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x78DB | 10476 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.