MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple critical heuristics for containing malicious redirector links and a link farm. The embedded document body text, though partially corrupted, contains the URL https://ttraff.club/wix?keyword=online+learning+platforms+for+students, which is identified as a malicious redirector. The presence of numerous external PDF links, many pointing to benign-looking files but likely serving as part of a larger SEO poisoning or redirection scheme, strongly suggests a malicious intent to lure users to harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=online+learning+platforms+for+students
- http://muzodo.sydunicheer.com/uploads/1/3/1/6/131606149/xenobewovujis_gafifufezaw_budajom_vaxom.pdf
- http://risavul.enzobrand.com/uploads/1/3/1/6/131606165/guzotude.pdf
- https://4e5a7c8f-877e-4b36-b704-6c7fc6ce156b.filesusr.com/ugd/3283b0_5ef81d6ca4734204b4fd9f03299696af.pdf?index=true
- https://8fd54a8d-8226-4abc-b058-f69ac76b0c2a.filesusr.com/ugd/98e2de_58a287f1fb2d4ba6b3b2d11273a6ffba.pdf?index=true
- https://f2897c79-e199-4360-9d23-aaa815dcbfe0.filesusr.com/ugd/f17c08_eb25e179aab14aa1a90d6a12bec75d2f.pdf?index=true
- https://e32505f9-363c-4d83-9334-14b5d97d2aa0.filesusr.com/ugd/97634b_109ed63ff22d4b688cf4d3560e96eedb.pdf?index=true
- https://83bcff9b-8823-4646-87fb-a7d9937bf4ef.filesusr.com/ugd/ff3115_25be7e64d4374d92ad8498e05b00d6bc.pdf?index=true
- https://4e1a7ab8-832f-412e-9e44-f44e71d9f25d.filesusr.com/ugd/739437_582a0131150f4c988b3a9b5a4d3f9afe.pdf?index=true
- https://5a447fd8-9151-4ec1-b452-a17005591cd0.filesusr.com/ugd/a838c0_e4669efe50fe40a5934f3d9bb7b151b0.pdf?index=true
- https://683cbae4-eca3-45c7-9873-105f12269bac.filesusr.com/ugd/fedf23_5b69a9930a3a4b85902f4803fce7031c.pdf?index=true
- https://32cf030e-661c-46e4-9510-ec8912728ca3.filesusr.com/ugd/3f80ec_f39d9c065bb348599f2671778c9a9830.pdf?index=true
- https://6f3f4a8e-0914-440c-ad4e-aca554b242a1.filesusr.com/ugd/28146e_729ecf208ea14fb88ed37a29ac33e7e7.pdf?index=true
- https://bb879766-d64f-4eaf-9ba8-6ff81681606f.filesusr.com/ugd/03ae60_295ed443c5cb4bfbb95fc3cc38027549.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000667a.bin3d2edb4987749d663243ed7d0e5f7f81a1044d592c0661c5b6aeb53c6a38d3d4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x667A | 5388 bytes |
font_01_sfnt_off000078b9.bin3ee1c93e6da66b54b8590533e94eb338cec6f1e5623b6a16e5e2316b0f127304 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x78B9 | 10744 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.