MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous links, including one pointing to a known malicious redirector infrastructure. The ML classifier strongly indicated maliciousness. The document body, though heavily obfuscated, contains a URL that appears to be part of a link farm designed to attract traffic, likely for SEO manipulation or to distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gettraff.ru/strik?keyword=low+level+language+definition+computer+science In PDF document text
- https://cdn-cms.f-static.net/uploads/4378852/normal_5f93cf63587cc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379841/normal_5f959c8f38669.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f8701d9643cd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426682/normal_5f97cb3b67b0b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382418/normal_5f8e38bb2020d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/minaxigevani/42214084223.pdfIn PDF document text
- https://s3.amazonaws.com/fibesezati/fundamentals_of_computer_programming.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd85aa62-439f-4abb-838a-ebfbca9bfce3/organic_chemistry_2_mechanisms_cheat.pdfIn PDF document text
- https://s3.amazonaws.com/fusidejebi/juzezazo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/3826/8318/files/khaw-fee_manual_coffee_grinder_reviews.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files2/descargar_diccionario_en_ingles_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b67f8492-5411-414e-85d8-2eb3378965df/5239873201.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f723634-0ea5-4479-83f5-5bbed76c3b99/93621047196.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/6272/9125/files/95414174845.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ee99e2a-8a9a-41e5-b872-70118807b5cb/30948737822.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01394ae4-2f18-4375-8b5c-a319fd988b0d/types_of_photo_galleries_for_websites.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2308995-612b-43a7-a5e5-d02f77222dcc/gizunun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69838296-a36b-4300-a8e8-b5800ed96faf/23255239649.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c440fc9b-1582-45f5-910f-91d60d99d890/fokojawat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73cfb7fd-98bd-4f86-a02e-5ef241030dec/pharmaceutical_market_access_trends.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18a24732-a22b-46e8-b3d9-1bbb503d3a64/8705415256.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76ec3167-b7ad-4969-9a4c-c2fa73d4ce3e/19227399791.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/5499/7402/files/64591192706.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c152d325-97d4-485c-93ad-5e5fb33ff114/musonuk.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0478/7398/2630/files/van_meter_school_calendar.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/3158/2622/files/systems_with_elimination_maze_answers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000076d6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76D6 | 5568 bytes |
SHA-256: b7339db36d69ee1957f9fbbf9ec7e21a5c22b42fcb2f04ca67154ee94fd70d0d |
|||
font_01_sfnt_off000089d6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x89D6 | 10620 bytes |
SHA-256: 582e4fcc43caa173d5150d92c575e99ab51f7784567478d389522cfe87bce66e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.