MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The primary malicious URL identified is 'https://ttraff.com/pify?keyword=cara++video+dari+pinterest+di+iphone', which is likely used to redirect users to malicious content. The document body contains garbled text and metadata indicating it was generated by wkhtmltopdf, suggesting it's not a legitimate document but rather a container for malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=cara++video+dari+pinterest+di+iphone
- http://files.bestillmove.com/uploads/1/3/1/6/131606016/zupekuxuduti_midusolajawoli_kigodukanon_ruwadibili.pdf
- http://files.stewartsghinc.com/uploads/1/3/0/7/130739155/kobiguti.pdf
- http://files.dunbarparishchurch.org/uploads/1/3/0/8/130814127/1289233.pdf
- http://kaluxokuk.embracebotanicals.com/uploads/1/3/0/8/130874277/1907118.pdf
- http://files.bizraeli-anglo.com/uploads/1/3/1/6/131606397/764548.pdf
- https://cdn.shopify.com/s/files/1/0443/3005/7884/files/biochemistry_satyanarayana_ebook_free_download.pdf
- https://cdn.shopify.com/s/files/1/0431/5817/5906/files/81637125934.pdf
- https://cdn.shopify.com/s/files/1/0431/6761/3087/files/duruvedetewerunekigoko.pdf
- https://cdn.shopify.com/s/files/1/0431/3792/5269/files/wuwuv.pdf
- https://cdn.shopify.com/s/files/1/0429/9443/4207/files/chemistry_12_formula_sheet.pdf
- https://cdn.shopify.com/s/files/1/0434/4433/8838/files/30868110.pdf
- https://cdn.shopify.com/s/files/1/0432/0401/8336/files/mivumiwetar.pdf
- https://cdn.shopify.com/s/files/1/0432/1630/6344/files/rojonoka.pdf
- https://cdn.shopify.com/s/files/1/0437/8856/6677/files/physics_giambattista.pdf
- https://cdn.shopify.com/s/files/1/0437/4953/9989/files/taxegexigunoragunejeg.pdf
- https://cdn.shopify.com/s/files/1/0429/2768/5788/files/20333490938.pdf
- https://cdn.shopify.com/s/files/1/0429/0058/6649/files/98364597541.pdf
- https://cdn.shopify.com/s/files/1/0432/4828/7912/files/41600923483.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006ad5.bin11d58023035c234d8fb134beb7a02dd0496bcb95ee8268bad49d5d59565e587c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6AD5 | 4980 bytes |
font_01_sfnt_off00007bc1.binfb5c041412b74e3d98bdbb740cc24836cfd7cd66ec855e9791e8813b489ab98f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BC1 | 12396 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.