MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, many pointing to what appears to be a link farm designed for SEO manipulation. One prominent URL, 'https://ttraff.club/123?keyword=tie+dye+stripes+instructions', is flagged as malicious. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the structure and embedded links suggest a phishing or scam attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/123?keyword=tie+dye+stripes+instructions In PDF document text
- https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/patakabewebujimar.pdfIn PDF document text
- https://nulixedupalaz.weebly.com/uploads/1/3/0/7/130739510/2723535.pdfIn PDF document text
- https://tegugozitofo.weebly.com/uploads/1/3/0/8/130874592/gejezojuzigew.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369150/normal_5f885c3f28c8d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367296/normal_5f8af6c22800d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0435/3071/5288/files/97966118860.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/2011/4331/files/48155593595.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0492/8028/6876/files/r410a_refrigerant_lowes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a33cd1a-0370-49d1-a301-920eabd83212/89248110075.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e05b3100-9c36-491d-81f7-312cbde862a0/lomis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ead9da98-b9fb-40df-94dd-9a2b6c0ce4a5/mosijo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1728343e-8b8f-408e-a955-1bd0980f0d9c/vizoporabutevesofizosoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/374352a4-dd69-4db8-a413-e2d422213b08/nuzupakow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e070fc6-c1b5-4ec6-becf-09ef4e271afa/kepipoginud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9fcd2254-ea86-48b2-9cd1-ce35cb0a375d/nakewurikolerivif.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa17f05b-f4e9-4579-81d8-dfee3a5b5fa5/bukaxamesapeb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b22ba341-9259-410b-b95d-d22de6d15cfe/gevivaxaxusejirom.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/0790/1335/files/casio_wk1630_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/1620/5989/files/amazon_phone_interview_questions_for_quality_assurance_engineer.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0457/3783/6710/files/female_warforged_names.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0480/3991/9780/files/6743252448.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/5952/8355/files/75345263827.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000076dd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76DD | 4756 bytes |
SHA-256: 388f57486452890af57b118322174283589029fe70bfc9e8194f6e357b837d26 |
|||
font_01_sfnt_off00008710.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8710 | 2212 bytes |
SHA-256: 79777cc3bf14d7c36a1b02e3a6eec7776755bc8dd20168ec0a9c245fb2c46eda |
|||
font_02_sfnt_off0000912b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x912B | 10896 bytes |
SHA-256: 2022f963c0db4ab9eb0b23f1eca1e21be0913db453113b7c831b7f79b56d6fbb |
|||
font_03_sfnt_off0000b5da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB5DA | 16500 bytes |
SHA-256: 2d244fcfe1b5e855795f82119be7f6f6bcc2dbbb6ff11d5fa4fd14185f343889 |
|||
font_04_sfnt_off0000cc1e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCC1E | 4324 bytes |
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.