MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged as malicious by an ML classifier and contains multiple embedded links. One of these links, 'https://ggtraff.ru/strik?keyword=fibonacci+sequence+python+using+for+loop', points to known malicious redirector infrastructure. The document also exhibits characteristics of a PDF link farm, with numerous external links, suggesting an attempt to direct users to potentially harmful content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/strik?keyword=fibonacci+sequence+python+using+for+loop In PDF document text
- https://cdn-cms.f-static.net/uploads/4416675/normal_5f95e76d2d71f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369901/normal_5f8a15356969c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/159beaff-cfe6-48ec-80b5-98b96ff82414/1000_accords_guitare.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cf12c507-bcd8-4fc2-a06f-8f2cbb7a0ab1/54831288871.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/940ce474-c047-4594-b92d-0761cc9bdc84/4654416018.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a040e6c5-a1f7-4bee-8811-ed6799da987b/kedifefapazoge.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/7482/0528/files/top_notch_1a_second_edition.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0485/2147/8299/files/bikavofilovunesifopugofaf.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0268/7349/5734/files/41008078518.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/2994/4222/files/libro_lazarillo_de_tormes_resumen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87d1807c-f66a-48f0-807e-5e622ae62098/how_to_uninstall_voicemod_voice_changer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99d4f1d4-4204-4b43-af8f-545b0e347905/firaluvilimaluxukaguvota.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38b29ce7-43cf-4d27-bb40-926a1350f9dd/29051141013.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22f4b5d8-0636-454b-a17c-596e56eb0708/76210216513.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/118b287f-d7f4-4ae2-9282-6b60e021bfc1/how_did_the_reconquista_affect_spani.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/59864936-58ec-47e4-97be-79ea41640541/funarukaporebivejogopivi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6628561d-6895-4ed3-841a-9ce3e17c6393/joxenumefezedojasono.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0af136ca-fb81-4493-8b92-6e40793d2a27/obscure_aftermath_ps2_iso.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/6250/4855/files/a_hora_da_estrela_docero.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/9822/5863/files/79245659780.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/8518/8258/files/23059827122.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/3481/9783/files/xerox_b7030_user_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/8488/1827/files/roxasuxogejulon.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006ffa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6FFA | 3440 bytes |
SHA-256: 03578c125c15db9e7bf322d57a54f09836611e47565e7676308bb3cea1b06950 |
|||
font_01_sfnt_off00007c5f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7C5F | 5600 bytes |
SHA-256: d91a0f42dff10e12965f147641097b8c83ce8fe27aefc9cbb58eef017c46174b |
|||
font_02_sfnt_off00008f69.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8F69 | 11204 bytes |
SHA-256: 056cb1063268b9d5a4fad0a6b44cbea9914abba05c87059c5e649775f666caa4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.