MALICIOUS
192
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a prominent link that redirects to a malicious URL, disguised as a download for a comic book. This is further supported by heuristics indicating a malicious redirector and a link farm designed to appear as legitimate PDF content. The document body, though heavily obfuscated, contains the lure text and the malicious URL.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 6
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/123?keyword=queen+bee+comic+book+pdf In PDF document text
- https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/xijilopofux_vabozudorog_kuzugemixonagi.pdfIn PDF document text
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/zidebesirolabavo.pdfIn PDF document text
- https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/3314470.pdfIn PDF document text
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/5117028.pdfIn PDF document text
- https://mamunazeve.weebly.com/uploads/1/3/0/8/130814121/6fdf5fb01.pdfIn PDF document text
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/bigunurusipota_vovavubavuw_malolipesafa.pdfIn PDF document text
- https://namunobuwuper.weebly.com/uploads/1/3/0/7/130776476/108d423a893.pdfIn PDF document text
- https://vonubaxuted.weebly.com/uploads/1/3/1/4/131452839/lasezuvafuji_kabonudisa.pdfIn PDF document text
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/kezedivalo-bolumukejufufik.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0495/5255/6184/files/makalah_pupuk_kompos.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/8212/8291/files/vozaro.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/6226/3459/files/85332470851.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/4202/9215/files/enterprise_car_rental_e_receipt.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0439/2602/8456/files/nasekisofigijuli.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a807f10-c687-4f21-93c3-734bbbf29256/9500162305.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f179c8b3-a17a-4fee-8540-16265d3726c8/wazefebafopeponodaxe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a93aa63-4703-4319-b646-0de761affee7/gusalu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006687.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6687 | 4852 bytes |
SHA-256: cea3dbf0f8632b0ce07c207e024b2444c95b6b4d833af2804fc4fdb90b89034c |
|||
font_01_sfnt_off000076e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76E4 | 10764 bytes |
SHA-256: 2387b168184b011eb7c95b22d7a9635da68ee46bb23f055e1924a42b8fd1e07d |
|||
font_02_sfnt_off00009bc4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9BC4 | 16368 bytes |
SHA-256: 552e926f59ef53231249b6015cc51882b512f7a40c6b17c25f707dc25a221893 |
|||
font_03_sfnt_off0000b18f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB18F | 4324 bytes |
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.