MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF contains numerous embedded links, including a primary redirector link to 'ttraff.link' and a mass external PDF link farm pointing to various domains. The document body, though partially obfuscated, suggests an educational context ('Algebra 2 solving systems of equations by graphing worksheet answers') used as a lure. The ML classifier strongly indicated maliciousness, and the PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms the presence of links to known malicious infrastructure.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=algebra+2+solving+systems+of+equations+by+graphing+worksheet+answers In PDF document text
- http://virepewi.reelresin.com/uploads/1/3/0/7/130775531/kowilotawomovam.pdfIn PDF document text
- http://files.carplakesfrance.co.uk/uploads/1/3/1/3/131379246/2302a8e05183.pdfIn PDF document text
- http://files.countrycreations4u.com/uploads/1/3/2/6/132695575/birofexo.pdfIn PDF document text
- http://videgafix.mightygreen.com/uploads/1/3/1/4/131438888/8727020.pdfIn PDF document text
- http://nobezan.royalqueendom.com/uploads/1/3/1/4/131453512/401ae3b2dda217.pdfIn PDF document text
- http://naginanux.jessicaleemanton.com/uploads/1/3/1/4/131406676/silariza.pdfIn PDF document text
- http://jotolu.psychoneconference.org/uploads/1/3/2/8/132815196/zepikoxamatem_fajusaromofeluz_sinesuvu.pdfIn PDF document text
- http://xotis.yamayogacollective.com/uploads/1/3/2/3/132303229/00dcb45a0219b.pdfIn PDF document text
- http://lidapunu.urqigong.com/uploads/1/3/0/9/130969723/5516672.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/8829/8659/files/69274702250.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/2541/3782/files/gezegax.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/5792/9623/files/sakura_dungeon_luck_statue.pdfIn PDF document text
- https://cf088d8a-1a80-4793-a990-c21c1c8e9e52.filesusr.com/ugd/880a7e_2d84d5b319e948d58fefe80d5ff3e6db.pdf?index=trueIn PDF document text
- https://47048abb-889b-4734-b1f2-0853ce5066e3.filesusr.com/ugd/031dda_12ba389f337a411093c528b652985d80.pdf?index=trueIn PDF document text
- https://97d746e6-48c5-494b-a5aa-5fcca1573702.filesusr.com/ugd/93c935_aedeee518db04bd083e5933d83c86c28.pdf?index=trueIn PDF document text
- https://10aaaff3-b944-4a23-8741-f192043f1516.filesusr.com/ugd/b1b16e_22896dd1dae444d386cec345ace56789.pdf?index=trueIn PDF document text
- https://4ade458e-dac3-4390-a02e-becc1ad826df.filesusr.com/ugd/1479de_32abb783281b4c168779993ebd1c422d.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000062dc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x62DC | 6020 bytes |
SHA-256: d4677f8fb298d61dac84c411927767351e8566e0539c9ef76410ab11089623a1 |
|||
font_01_sfnt_off0000774c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x774C | 10168 bytes |
SHA-256: b5d0533e680a436cfed929ed3cfd0b0a060c848fc501ea11f14225c6c1d8f06f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.