MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=best+reptile+and+amphibian+field+guide'. This indicates an attempt to lure the user to a potentially harmful site. The document body, though heavily obfuscated, also contains this URL, reinforcing the malicious intent. The presence of numerous other PDF links suggests a link farm or SEO poisoning tactic to distribute the malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=best+reptile+and+amphibian+field+guide In PDF document text
- http://bolij.rosariumsouthafrica.com/uploads/1/3/2/6/132695887/xupop.pdfIn PDF document text
- http://vutedo.belleaurum.com/uploads/1/3/2/8/132814930/sawosimafafo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://3a4a7bca-9114-4797-a518-a890cde919f1.filesusr.com/ugd/594ae5_e73142f4a7f143f5977b4168d8aaa789.pdf?index=trueIn PDF document text
- https://29296484-a485-45a8-8e41-e55ed1761cdc.filesusr.com/ugd/3f80ec_699c250fe22643af85f83f4ee0932eab.pdf?index=trueIn PDF document text
- https://fec15ea4-fa4b-4624-bc4a-98aa367d6ff3.filesusr.com/ugd/86319b_858356a442744076a107fd9cd1f44b5f.pdf?index=trueIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/6676/9054/files/juwasewibigisag.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/6055/1070/files/jotelo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0460/1620/0863/files/30168260734.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/3646/5559/files/movies_online_from_any_website.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/1384/0794/files/pemogebagazelamufisipufet.pdfIn PDF document text
- https://7afb284c-808d-4b1a-acd5-a39d06a6ec9e.filesusr.com/ugd/e948c1_4797f563606e40d78d2c9f07e925268e.pdf?index=trueIn PDF document text
- https://6133760c-5bbb-4e5d-8bec-5945d96f681c.filesusr.com/ugd/41a0b6_70e89927203049fb8779aabc86b5e229.pdf?index=trueIn PDF document text
- https://97eefccd-6c7c-4120-b91d-409801bc1cb0.filesusr.com/ugd/595093_c015e2195fbf479e99364df8a2283f2f.pdf?index=trueIn PDF document text
- https://25dedf25-0133-45ab-b18e-1f37b8a9e232.filesusr.com/ugd/cbe7f7_34b709f1b4b34d72bdcfaa154fac7834.pdf?index=trueIn PDF document text
- https://f8d69607-09d0-4b39-8a28-7b1bd2c519de.filesusr.com/ugd/0cd019_f8e71ad2de244be1a8012f202304b7d2.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006a24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A24 | 6744 bytes |
SHA-256: 0eac1552a6a0cc8d6d43e14f5c157d052ff2bf21460314f67a2c213e0a454e63 |
|||
font_01_sfnt_off00007b0b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7B0B | 5644 bytes |
SHA-256: 4e4f47e209ce71c31c61504821948604c9c00bbbef9f5ca18ea6a57455b4e07e |
|||
font_02_sfnt_off00008e0c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E0C | 10424 bytes |
SHA-256: 280e2b2f4006816e68aec0be6dd1c0e7f263be788a84cc4ebf876739b6124c8d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.