MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a mass of external links, with one prominent link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a song title and metadata, suggesting a lure to disguise the malicious intent. The presence of numerous PDF links, including one to a redirector, indicates a likely phishing or scam campaign aiming to lead users to malicious content. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=reptilia+bass+cover
- http://gibusupab.hedgequote.com/uploads/1/3/2/7/132710654/nejawotitutasu.pdf
- http://fobagik.bebeckerlegartanddesign.co.uk/uploads/1/3/0/8/130874218/95384.pdf
- http://migupizib.electricaloutlet.info/uploads/1/3/1/8/131859527/27a2470.pdf
- http://files.tillersmath.com/uploads/1/3/0/9/130969434/75066b99189aec2.pdf
- http://files.backyardhackers.com/uploads/1/3/1/6/131606533/2433553.pdf
- https://7a38fc8f-5324-45ad-91b3-19f660c3bfe9.filesusr.com/ugd/c6ac46_4d06aafad79c4002a489f1b4205465e6.pdf?index=true
- https://f6c20033-93e0-410f-bdc2-d0c29681c6ff.filesusr.com/ugd/a771bd_1b640a0ddf544592a0f0ec3ce71cdbfa.pdf?index=true
- https://73dfbb2e-e61d-41e3-b0f0-76cb38fd6df2.filesusr.com/ugd/bc79a4_458511094f264238a1f627ec0bfdefcb.pdf?index=true
- https://1b2e711b-3772-4e0e-802a-89d17218c9f9.filesusr.com/ugd/7a7fb1_fd1c6afc452f4614bae2d09deb790359.pdf?index=true
- https://d3f0c222-3d6d-47b1-b421-e883a81fe8da.filesusr.com/ugd/daca0d_8df95d14d7294490ab62dce3ee8c00fa.pdf?index=true
- https://731f0f06-232e-44a6-830e-05ab73127fb6.filesusr.com/ugd/ebbcbd_77f78b0827454af58124ed8ba5624378.pdf?index=true
- https://eb8340e4-fc66-4d65-9e72-8a9ca71a8680.filesusr.com/ugd/738632_74d938e9de3b4f9b85f963caf62fde86.pdf?index=true
- https://e0d710f7-1ef6-4840-a808-d8d5fa211de6.filesusr.com/ugd/d8966e_5f9e8afc74f54134bc7bf0e6d2b70ab2.pdf?index=true
- https://7a4c677f-97b3-4319-a360-42a4124d752f.filesusr.com/ugd/f523c3_ad179328845d44f4b17cca46bff841aa.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004e25.bin4bb5d83102db123b5838f392db8d6f2eb288f26a17a93feff82022b1e178f2e0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E25 | 5136 bytes |
font_01_sfnt_off00005fb1.bin1514d3361cd29df8d4c1b3ecec281a9521d0e59a6086dd62c65bc24052da2687 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5FB1 | 12064 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.