MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though partially corrupted, suggests a lure related to a textbook solutions manual. The primary malicious URL identified is https://ttraff.club/wix?keyword=managerial+decision+modeling+with+spreadsheets+solutions+manual, which likely leads to further malicious content or exploits. The presence of a link farm further supports the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=managerial+decision+modeling+with+spreadsheets+solutions+manual
- http://files.atlanticharmonybrigade.com/uploads/1/3/0/7/130775971/9ec5011639e6ed.pdf
- http://files.eatsouthshore.com/uploads/1/3/2/6/132681293/06daca22f85a08.pdf
- http://sixof.thewineswirler.com/uploads/1/3/1/6/131606228/tabuvuduza.pdf
- https://76612c57-c1dc-4315-888f-268ad7b711ac.filesusr.com/ugd/9c58c5_efa1c9ffd1c8460986e303a67d39940e.pdf?index=true
- https://e552a6a0-75eb-4fef-b920-aac76687ec8a.filesusr.com/ugd/b42fd6_0a0c48ef51e943128cdbe75258b520e7.pdf?index=true
- https://646d9de3-a57d-4f07-bfb8-0024ef3aaeae.filesusr.com/ugd/6908d7_9a55cedf3b224e99b442df9cfd6cb2ab.pdf?index=true
- https://ae8adc37-4d3a-4999-bad0-4b15d1ee8843.filesusr.com/ugd/2eec94_569a2b0779284e8b987831034dad75da.pdf?index=true
- https://f5b4567b-d810-4a22-9c6b-4f9278f998f1.filesusr.com/ugd/afbef4_2a2263e566d441cab08bff50fc844e04.pdf?index=true
- https://0b2c6eb1-7951-40ac-bb2b-4bebf01f841d.filesusr.com/ugd/74e9cf_5d120ecabf534d688aa751cd7154c6f4.pdf?index=true
- https://501453bd-2346-475e-a566-1bfa12237745.filesusr.com/ugd/c0a468_dd68d84200c840eca1837aaf46e63356.pdf?index=true
- https://4ae9076e-a445-4741-9c85-55a73024a4fe.filesusr.com/ugd/5b9a87_a07876f6219b49a49bea79def1016a8b.pdf?index=true
- https://aa35a6ab-81d9-406d-9aa0-78a5d84c2451.filesusr.com/ugd/5f4192_2481382d8c2349d79638b340e260c064.pdf?index=true
- https://9185236b-c863-42e7-af53-4666d561d293.filesusr.com/ugd/dad7b5_46db532eb8cf46709c72a51b81550552.pdf?index=true
- https://a9f07397-fe83-4b8c-9ec7-79bfdc60583b.filesusr.com/ugd/4479ed_e00c17287054485da316a2ceab533dec.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000492b.bine92d2ee806ee328c830cc71d1148d5d4ca7057b7135c5a19f8dc78b519fd69a6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x492B | 5584 bytes |
font_01_sfnt_off00005c19.bin01cbf4b07d89b2f7ffe84e351a7e5b9b21e523c53e52c7eed1594c9900d7db1b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5C19 | 10276 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.