MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a significant number of embedded URLs, with heuristics indicating a link farm and redirection to known malicious infrastructure. The document body, though heavily obfuscated, contains the URL 'https://ttraff.club/wix?keyword=para+que+se+usa+las+comillas', which is flagged as a malicious redirector. This suggests the primary purpose is to lure users to malicious sites, likely for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=para+que+se+usa+las+comillas In PDF document text
- http://zukejuv.thefriendshipcentre.co.uk/uploads/1/3/1/4/131437515/1190087.pdfIn PDF document text
- http://files.rosytoesdesigns.com/uploads/1/3/1/4/131409498/xilelaxabedupa.pdfIn PDF document text
- http://files.wanderlusthrts.com/uploads/1/3/0/7/130739142/49c8483a9ec.pdfIn PDF document text
- http://files.kelseysmarina.com/uploads/1/3/0/7/130775498/3c70d.pdfIn PDF document text
- http://files.abingtonpolishing.com/uploads/1/3/1/4/131454034/bipepunuzowugus.pdfIn PDF document text
- http://gigajegi.indiangrovechurch.com/uploads/1/3/1/4/131454172/lovol.pdfIn PDF document text
- http://files.srphotographymelbourne.com.au/uploads/1/3/1/3/131398351/mapomapufi.pdfIn PDF document text
- http://files.our-perspective.com/uploads/1/3/1/6/131606493/4436a.pdfIn PDF document text
- http://files.burnsidecoaching.co.uk/uploads/1/3/1/8/131871994/6230276.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://72a42805-aeb7-4443-b8bb-3faba269e53e.filesusr.com/ugd/6f53d7_fdf9090257184c50b7c7dceadba6bd4c.pdf?index=trueIn PDF document text
- https://8ec14ef5-b176-4990-b308-1ed4aaa92632.filesusr.com/ugd/98d33d_a8d9896be614431f9966d25b3b1d9338.pdf?index=trueIn PDF document text
- https://36c4c05c-4b01-4797-9f1e-4b98182206e0.filesusr.com/ugd/e3c460_6f0b3684b36d4516b4eab3857113f9c6.pdf?index=trueIn PDF document text
- https://5804f943-7c2e-4759-8642-2dfed2a6133c.filesusr.com/ugd/1849a1_0e1bc3bca6634c3685ecef4d604f7171.pdf?index=trueIn PDF document text
- https://69c1b85a-845a-473b-97d5-e0114ffcd775.filesusr.com/ugd/a771bd_4e687d1136954de5be39d76d57e364e5.pdf?index=trueIn PDF document text
- https://15ffddfd-bece-4e22-b6fa-e5e4fee9a1c1.filesusr.com/ugd/cc089a_c102fc216d214deb92603c9906d6fe9e.pdf?index=trueIn PDF document text
- https://8e01efe6-6fa1-45ce-9033-beee2265399c.filesusr.com/ugd/01e791_8024cd552b5b4066bb8fbcc0f48e26b3.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007079.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7079 | 4764 bytes |
SHA-256: 4e92a12f8aad83166833cdc909aee7ca6c048f49591fa2169c6cbf3c5cc5cb9a |
|||
font_01_sfnt_off000080ed.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x80ED | 5072 bytes |
SHA-256: 0fa23acd2886728f2c864817cfe25c51dbfcb50d6176b018f3bb6e8e21fda63e |
|||
font_02_sfnt_off0000921b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x921B | 12444 bytes |
SHA-256: 26aedeb63f6a337522aa7cb5367f521ff5d76e20e9d85be785c1ee394f083d59 |
|||
font_03_sfnt_off0000ba3d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBA3D | 16164 bytes |
SHA-256: 80445f2abe94c9d771dd9a4f5b14a7969aca95ead3220a7d882418edf0a4b938 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.