MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to a 'GPS vehicle tracker manual' and the malicious URL, suggesting a lure. The PDF_SEO_LINK_FARM heuristic indicates a large number of outbound links, common in SEO poisoning or link farm abuse to drive traffic to malicious sites. The ML_NYX_PDF_MALICIOUS classifier strongly supports the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/123?keyword=gps+vehicle+tracker+manual+espa%25C3%25B1ol
- https://tarirubawapub.weebly.com/uploads/1/3/1/6/131606173/webaz_xaxuxubigidezop_lotaduvupala_bisovexowidogir.pdf
- https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/katilus-kolitumupogi-junipoxovak-zotesu.pdf
- https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/gazarifiri.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f8acc9d079dd.pdf
- https://cdn-cms.f-static.net/uploads/4366958/normal_5f87c75c7a3b4.pdf
- https://cdn-cms.f-static.net/uploads/4370785/normal_5f8b03739fda8.pdf
- https://cdn-cms.f-static.net/uploads/4366316/normal_5f89ab0ed3f08.pdf
- https://cdn.shopify.com/s/files/1/0501/6043/5357/files/12th_chemistry_important_questions_free_download.pdf
- https://cdn.shopify.com/s/files/1/0486/4062/2760/files/52745435764.pdf
- https://cdn.shopify.com/s/files/1/0430/8487/3879/files/bartholomew_and_the_oobleck_1949.pdf
- https://uploads.strikinglycdn.com/files/3ce5bbda-3442-4ba2-b535-c58bcafac76c/dunibuxogonegatire.pdf
- https://uploads.strikinglycdn.com/files/d8d2c1a6-4338-4718-b68b-a3e451d8529f/kamatijopukumorosebinuxu.pdf
- https://uploads.strikinglycdn.com/files/7137a49d-3b64-44f0-9c46-3b01fc367419/kumurazejewapu.pdf
- https://uploads.strikinglycdn.com/files/795b3d05-d468-4b62-b9dc-c7c0ff75910e/dodge_545rfe_transmission_specs_and.pdf
- https://uploads.strikinglycdn.com/files/7995a3df-50b2-49fd-86b9-d4a51a8a9b32/finowi.pdf
- https://cdn.shopify.com/s/files/1/0480/6112/0676/files/tennant_s30_sweeper_manual.pdf
- https://cdn.shopify.com/s/files/1/0266/9825/2457/files/11379271324.pdf
- https://cdn.shopify.com/s/files/1/0484/5453/3281/files/71275864491.pdf
- https://cdn.shopify.com/s/files/1/0479/6268/5607/files/my_hero_academia_costumes_for_halloween.pdf
- https://uploads.strikinglycdn.com/files/6f6e4efd-ec8a-4a63-b68f-8997dd986651/80700637779.pdf
- https://uploads.strikinglycdn.com/files/090fa792-def2-4377-b283-6fa9bb1c9237/4892558154.pdf
- https://uploads.strikinglycdn.com/files/61eea719-b54d-463a-b34f-751a78d30f87/93827940945.pdf
- https://uploads.strikinglycdn.com/files/bb8000e4-1d7a-4a43-b775-8cd18498d7ca/jubodizaw.pdf
- https://uploads.strikinglycdn.com/files/824d64e1-51ba-4188-9736-c50d522709d2/69160043220.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://uploads.strikinglycdn.com/files/795b
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007035.binfd66601a6c24d1d0fe4ed599557fc9143906cdc577167ace6d104b3a6fe84512 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7035 | 5540 bytes |
font_01_sfnt_off000082ad.bindd294e2b2db5e9fcad14262fe950b1af677b9d77fa0a64b98a8fb2fa76edcae8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x82AD | 10360 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.