MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains this URL and also references a 'Klamath river salmon report', suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on Shopify. The primary malicious URL is likely used to redirect users to a site that distributes further malware.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=klamath+river+salmon+report
- http://files.laureldelp.com/uploads/1/3/1/3/131383775/bofudesipoduzixo.pdf
- http://vikilaxuz.findingancestors.net/uploads/1/3/1/3/131398455/xevuluma-kepeladire.pdf
- http://files.chatswooddensitometry.com.au/uploads/1/3/0/7/130776386/gozemodalunup.pdf
- http://files.brewednblended.com/uploads/1/3/0/7/130775503/lawenikofop.pdf
- https://cdn.shopify.com/s/files/1/0437/2529/1674/files/75206849766.pdf
- https://cdn.shopify.com/s/files/1/0430/8706/9348/files/pufofogiwuzatu.pdf
- https://cdn.shopify.com/s/files/1/0433/7106/9594/files/naduwi.pdf
- https://cdn.shopify.com/s/files/1/0433/7316/6757/files/48421221309.pdf
- https://cdn.shopify.com/s/files/1/0436/0221/5069/files/aristoteles_metafisica_libro_2.pdf
- https://cdn.shopify.com/s/files/1/0436/5982/1209/files/jozasabupopujavalibubi.pdf
- https://cdn.shopify.com/s/files/1/0435/2291/6520/files/carnap_empiricism_semantics_and_ontology.pdf
- https://cdn.shopify.com/s/files/1/0437/0975/9640/files/vukimikowumobumo.pdf
- https://cdn.shopify.com/s/files/1/0437/1228/2789/files/research_title_on_accounting_and_finance_in_ethiopia.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/18491093394.pdf
- https://cdn.shopify.com/s/files/1/0429/3358/4035/files/weed_firm_2.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006366.bin7bbafdfec0e505468f793d0eb9506e47ced94c3f1dbebd91ffe7d8221b7dc808 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6366 | 5088 bytes |
font_01_sfnt_off00007495.bin84009a57460a7fc20161d7dc52340f03f21354f8b4d544fb2dd7072b7c5bb725 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7495 | 10340 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.