MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous links to external PDFs, many of which appear to be part of a link farm designed to improve search engine rankings. One of the primary links, https://ttraff.club/123?keyword=anatomia+do+sistema+nervoso+central+pdf, is identified as a known malicious redirector. This suggests the document's purpose is to drive traffic to malicious infrastructure, likely for further exploitation or phishing.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/123?keyword=anatomia+do+sistema+nervoso+central+pdf
- https://cdn-cms.f-static.net/uploads/4376127/normal_5f89ec1eaa716.pdf
- https://cdn-cms.f-static.net/uploads/4383915/normal_5f8ccf28704d6.pdf
- https://cdn-cms.f-static.net/uploads/4366956/normal_5f895b46a3a69.pdf
- https://cdn-cms.f-static.net/uploads/4376125/normal_5f8b7476de480.pdf
- https://cdn-cms.f-static.net/uploads/4385412/normal_5f8c7e145af8f.pdf
- https://cdn-cms.f-static.net/uploads/4369784/normal_5f8e164074122.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f8d371e16519.pdf
- https://cdn-cms.f-static.net/uploads/4369653/normal_5f8d3ebfc26a2.pdf
- https://xivenisulebitok.weebly.com/uploads/1/3/1/3/131378814/jerow.pdf
- https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/mijezanutimutavoze.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/d96ddb407408.pdf
- https://kuvofexe.weebly.com/uploads/1/3/1/1/131163751/fukajibevojib.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/78a9c51a-1881-466b-90e6-189c29c89cfa/50069159533.pdf
- https://uploads.strikinglycdn.com/files/ae45d7ef-c163-4b4d-9d2c-fdffb1ad9430/pizate.pdf
- https://uploads.strikinglycdn.com/files/721d8b8d-173c-4227-a262-09538b68814f/22402406465.pdf
- https://uploads.strikinglycdn.com/files/37c66869-0e1f-47b0-9d25-9cacf547d861/two_letter_consonant_blends_worksheets.pdf
- https://uploads.strikinglycdn.com/files/9da23511-d475-4b4f-b3e5-4acc631fe45e/83239151263.pdf
- https://uploads.strikinglycdn.com/files/4c933a66-d41b-4196-8faa-66d5a4b2a8ab/xunutanejilexubagetuvonut.pdf
- https://uploads.strikinglycdn.com/files/a7168b91-25ba-47e7-9508-56aad1146232/47395753536.pdf
- https://uploads.strikinglycdn.com/files/1a46fdaa-2839-4f40-bb8d-0b788d568be1/14452571438.pdf
- https://uploads.strikinglycdn.com/files/0a48a014-2f6f-4f2d-ae32-e5ca95ac1759/vufezikaregi.pdf
- https://uploads.strikinglycdn.com/files/9b595d6a-a2df-4e34-a480-7ff064c18014/pejukowofosijixejozajexof.pdf
- https://uploads.strikinglycdn.com/files/150cb13d-a819-4105-b7f7-e7f71ab6e3a8/zazixilonodiwip.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000113ad.binab72df9302f650f42d5ab0889596a9a62f383b291dd1c1b9596f7bb776faaedc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x113AD | 5352 bytes |
font_01_sfnt_off000125c8.bine543dc11c5822379d8769842018f222c240c1e845e7c05bc0d32a6825fb95bf7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125C8 | 13412 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.