MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of embedded links, many of which point to disposable hosting or redirector infrastructure, indicating a link farm designed to distribute malicious content. The primary malicious URL identified is 'https://ttraff.me/wix?keyword=the+pit+and+the+pendulum+quiz+answers', which is flagged as a malicious redirector. The document body, though heavily obfuscated, contains references to quiz answers and other PDF links, suggesting a lure to trick users into clicking through to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=the+pit+and+the+pendulum+quiz+answers In PDF document text
- http://files.inspirationoftime.com/uploads/1/3/1/3/131379803/4d9e70af8ae9b4.pdfIn PDF document text
- http://pagizuz.urgasconouranimalshelter.org/uploads/1/3/1/8/131871787/e188e35826.pdfIn PDF document text
- http://ninokef.sunshinejeremiahwolfe.com/uploads/1/3/0/8/130873965/venorar.pdfIn PDF document text
- http://tesije.republicoftexans.com/uploads/1/3/2/6/132682076/runatenegegorew.pdfIn PDF document text
- http://files.reloadman.net/uploads/1/3/1/8/131871501/9768742.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://94b9545b-4f01-4cbc-800d-209e39fb81b3.filesusr.com/ugd/d90490_d3c93ea8b40f458e826fef4d5f128467.pdf?index=trueIn PDF document text
- https://8cfe4f32-33f0-44ee-a387-54d0b9f0c86f.filesusr.com/ugd/2f3ac6_410a6835c8574a23b93de5a3b8585ede.pdf?index=trueIn PDF document text
- https://3815b0b8-77ac-4df1-b00d-ef5f6c66fa6f.filesusr.com/ugd/2072cd_62aa8b2e6a5a471c8555572e0c597d56.pdf?index=trueIn PDF document text
- https://87abbf3c-220e-4f82-813a-c3ac0df448fb.filesusr.com/ugd/f91cf1_a2e1902e21ac4be88024b48c92a35c0e.pdf?index=trueIn PDF document text
- https://eb169909-e417-4019-94c3-5bf000992a53.filesusr.com/ugd/bc4951_d4b2cd208aec4efd8922623bc00ce85b.pdf?index=trueIn PDF document text
- https://ade06e1c-3292-4e87-86ae-c727e26b9a76.filesusr.com/ugd/067ecb_2b97ffa116e44ff9b3765a735672c05e.pdf?index=trueIn PDF document text
- https://44c14afc-0cf6-4466-9328-a72ac24d13df.filesusr.com/ugd/345929_f6fbf29817c5470687426e6ad79a8b56.pdf?index=trueIn PDF document text
- https://75d7c3e4-dfa8-4198-aa6f-b23fd97d1a17.filesusr.com/ugd/035627_27f4d024be634b429ac060a83b78b05a.pdf?index=trueIn PDF document text
- https://23b2471e-ab55-4cc5-a8da-776049998227.filesusr.com/ugd/a891c0_ef3aba019dde40a987896677aa35e1e3.pdf?index=trueIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/0183/9775/files/asterix_comics_free_download_deutsch.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/6171/3813/files/65132894669.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000049b6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x49B6 | 5416 bytes |
SHA-256: 0bd94430ef6a1fcdf94886bf158f086e21c05206a2700718a0a01227f6b6415e |
|||
font_01_sfnt_off00005c0a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5C0A | 9536 bytes |
SHA-256: 284194ae226177b9596f2efea8b81b59e605031f4976b4611abe2b2874d65cad |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.