MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link to a known malicious redirector, disguised with text about animal videos. It also includes a large number of links to other PDFs, suggesting a link farm or SEO poisoning attempt. While no scripts were directly extracted, the PDF structure and embedded links indicate a malicious intent to redirect users to harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/strik?keyword=videos+de+animales+chistosos+bailand In PDF document text
- https://xozanazefozi.weebly.com/uploads/1/3/0/8/130874019/d2c201.pdfIn PDF document text
- https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/punitetiva.pdfIn PDF document text
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/8627562.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368969/normal_5f886d222c608.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f889d39708c3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365540/normal_5f87113b4953c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365599/normal_5f8855f2cf39a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368230/normal_5f8840dcb4b03.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369912/normal_5f89955792de8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366319/normal_5f89e92d465be.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366949/normal_5f87d402bdbbe.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/825d0581-1961-46a2-b4ed-79718cca5350/getabuxazitobusegaresoju.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5bef860b-5501-4e6d-a8b1-4610058db89e/muxoxemorigudavanog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e77d2a5-049e-401f-a18b-53f8a8b0b648/77282270938.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b9dcc1a2-9ac6-4a11-bed4-8b8646a657a2/vanijax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4aa5f66a-0a62-41eb-aefb-ca4c63f8c1a4/jinuk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/52766566-795a-47eb-8684-b79f3d6f4e77/jidugudusiriwurov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d61dcbbf-9898-40a2-9894-0483286978cd/tedivudazumololesagikemuj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/23a495d1-ca5e-4976-b6c9-ab89dd9fec14/pabufefebese.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c058c572-cb9a-48eb-b417-1b1bb67666f9/30015374356.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d39e29ed-35b6-4795-a078-8f91cd0dfb31/73060531265.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/9474/8573/files/fuji_road_bikes_for_sale.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/5232/5272/files/podejukib.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6192/6293/files/filunizafe.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/8720/2971/files/muxezivowovefedatow.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/7804/8162/files/novena_to_st_peregrine.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000077f7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77F7 | 5188 bytes |
SHA-256: cc43a370675123dca7f5f22776a7163d8af465e9f346334ac1d47a44f9f651e2 |
|||
font_01_sfnt_off00008974.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8974 | 10748 bytes |
SHA-256: ff894957aa62908ee681422146412da8d5961f5a533995a3fab8079cd263c084 |
|||
font_02_sfnt_off0000acd1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xACD1 | 16092 bytes |
SHA-256: 39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.