MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged as malicious by an ML classifier and contains a critical heuristic indicating it's a redirector link to a known malicious infrastructure. Additionally, it exhibits characteristics of an SEO link farm, embedding a large number of external PDF links, with one prominent example being static.usrfiles.com. The document body, though heavily obfuscated, contains a URL that matches the redirector link found in the heuristics.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=ponte+en+onda+scooby+doo+capitulo+1
- https://static.usrfiles.com/ugd/b3bc21_b2e14369b650464a9b3f7c95e90f45c9.pdf
- https://static.usrfiles.com/ugd/b8c837_dd612951ca1747b4a411d83b7988187c.pdf
- https://static.usrfiles.com/ugd/90c678_c92dde325cab4c9a8107859aa9f4a9f2.pdf
- https://static.usrfiles.com/ugd/227d0f_f8cd63d0bc294eaf9ca3ff6ffdac0993.pdf
- https://static.usrfiles.com/ugd/f96b02_705b85ffda8741b99d30a2c27a48ac30.pdf
- https://static.usrfiles.com/ugd/b8c837_ecca9774b4e14120a00f63ae7b267244.pdf
- https://static.usrfiles.com/ugd/fac845_bb800490a262402295f17929f4bf6a5e.pdf
- https://static.usrfiles.com/ugd/067ecb_42424b3b7ac24e178cd057ce1e6bcc26.pdf
- https://static.usrfiles.com/ugd/2b3f46_cfa687cf592b41d281ef48eabed6aa5e.pdf
- https://static.usrfiles.com/ugd/d9d1f5_000e4f53bb8844b5941547430d21d0bf.pdf
- https://static.usrfiles.com/ugd/23e9be_6b5d391a5a2c4dee87af5190124f0a46.pdf
- https://static.usrfiles.com/ugd/b8c837_fbdc8e6b6902448cb83e89134be9ba4f.pdf
- https://static.usrfiles.com/ugd/b8c837_58c7b4841bae4ed893488f877f87e318.pdf
- https://static.usrfiles.com/ugd/b8c837_9789c00d347f4b03877ef1bc5c59f908.pdf
- https://static.usrfiles.com/ugd/b8c837_f4b4e6ad63e74aae84127cfbd282512b.pdf
- https://static.usrfiles.com/ugd/b8c837_32d0e5eec7444aec95b8c0c306ace257.pdf
- https://static.usrfiles.com/ugd/b8c837_9fb24b56143f48fe9235d6d03ba7d6b2.pdf
- https://static.usrfiles.com/ugd/bb13a2_1a349ff9a4c64a46888ec1580a50ec60.pdf
- https://static.usrfiles.com/ugd/b8c837_c5432a837e1640449b5d90d6a5e1ebe3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00009330.bin53fcc59aab3d0d03565472111e2a07e8c78a5b95a556a3f2019886a22544b9f2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9330 | 5264 bytes |
font_01_sfnt_off0000a52c.binebcab33e41c297865643e87790a49bfcb2e71de8b3c8364da3df4009808347e2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA52C | 10676 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.