MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a prominent link that redirects to a malicious domain, disguised as a 'free beginner guide to keto diet'. This link is identified as a malicious redirector. The document also contains a large number of embedded links, many of which point to a domain hosting numerous PDF files, suggesting a link farm or SEO poisoning tactic. The ML classifier strongly indicates maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=free+beginner+guide+to+keto+diet
- https://static.usrfiles.com/ugd/ccb1c6_64593eca76f649aeb112e04f3ea1a78c.pdf
- https://static.usrfiles.com/ugd/87d215_05c0a5e7774642d9b972b0ea20f4deea.pdf
- https://static.usrfiles.com/ugd/455f95_c5805960cc9040998c2d3ce163a151c4.pdf
- https://static.usrfiles.com/ugd/c068f8_b1ce24f039134570ac38dc4234721397.pdf
- https://static.usrfiles.com/ugd/ab922d_3b3c826223934d129b074c597cd1c582.pdf
- https://cdn.shopify.com/s/files/1/0433/9793/9361/files/19592421337.pdf
- https://cdn.shopify.com/s/files/1/0433/0569/7438/files/59376625582.pdf
- https://cdn.shopify.com/s/files/1/0431/3025/7568/files/neverwinter_wizard_build.pdf
- https://cdn.shopify.com/s/files/1/0431/5440/7580/files/fepepepobekobefa.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/lapifobojupe.pdf
- https://cdn.shopify.com/s/files/1/0440/5785/4102/files/97343540966.pdf
- https://cdn.shopify.com/s/files/1/0432/7096/3366/files/95301290510.pdf
- https://cdn.shopify.com/s/files/1/0429/8434/1657/files/vakarokodejakofudimize.pdf
- https://cdn.shopify.com/s/files/1/0433/8004/8023/files/jadipavetikodod.pdf
- https://cdn.shopify.com/s/files/1/0434/2258/0886/files/29908786700.pdf
- https://static.usrfiles.com/ugd/b8c837_3c110e82de454fb2bef28a9e1e904a6a.pdf
- https://static.usrfiles.com/ugd/8a419d_35e9c02773ee49d8b29848ef4c0f307b.pdf
- https://static.usrfiles.com/ugd/6846fe_67153d11a76540fd8ba608ca84042b98.pdf
- https://static.usrfiles.com/ugd/b8c837_41e8145f2cca49a898bf42a3af490ec6.pdf
- https://static.usrfiles.com/ugd/c0a468_6a25fd4966bb4061a0d8190c076a7eaf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00009c3b.bin45c4b04dacd3c4780ac245adff14d168cc3e224c6456c71260ecb302a244a703 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9C3B | 4616 bytes |
font_01_sfnt_off0000abf7.binf38895ee6e6252df0e00c07d1c02bac999d19e0ae9621500f16c050e77836c2d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xABF7 | 10440 bytes |
font_02_sfnt_off0000cfa4.bin1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCFA4 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.