MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on Shopify. One of these links, 'https://ttraff.link/wix?keyword=adding+rational+expressions+worksheet+pdf', is identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'adding rational expressions worksheet pdf' and the malicious redirector URL, suggesting a lure to a malicious site disguised as a document. The presence of numerous external links, including the malicious one, indicates an attempt to direct the user to potentially harmful content.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=adding+rational+expressions+worksheet+pdf
- https://cdn.shopify.com/s/files/1/0435/3123/9588/files/honeywell_water_heater_gas_control_valve_recall.pdf
- https://cdn.shopify.com/s/files/1/0440/7181/3285/files/alimentacion_complementaria_minsa.pdf
- https://cdn.shopify.com/s/files/1/0428/4622/4551/files/gegaxuzoseful.pdf
- https://cdn.shopify.com/s/files/1/0434/8028/5348/files/paketebaworel.pdf
- https://cdn.shopify.com/s/files/1/0428/3380/5471/files/pivigig.pdf
- https://cdn.shopify.com/s/files/1/0437/5999/2990/files/vmware_workstation_serial.pdf
- https://cdn.shopify.com/s/files/1/0440/0224/6814/files/e_mathematical_constant.pdf
- https://cdn.shopify.com/s/files/1/0451/1694/8633/files/brawl_stars_android_google_play.pdf
- https://cdn.shopify.com/s/files/1/0482/8987/4088/files/adobe_lightroom_lens_profiles.pdf
- https://static.usrfiles.com/ugd/e4a001_801f525fb20e4d41a696c76c2ff7c16b.pdf
- https://static.usrfiles.com/ugd/e6e573_ec9dfaeffafc42b890df25167134228c.pdf
- https://cdn.shopify.com/s/files/1/0429/1903/5033/files/41706762613.pdf
- https://cdn.shopify.com/s/files/1/0434/0521/3847/files/napigupuvoga.pdf
- https://cdn.shopify.com/s/files/1/0439/3605/5454/files/munich_map.pdf
- https://cdn.shopify.com/s/files/1/0431/0951/5425/files/grilled_buffalo_chicken_salad_nutritional_information.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/58657968950.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000912f.bin4aba2bb845853324476be69e5ed1bf4ff35002942389efac2b843cac1129f0e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x912F | 2828 bytes |
font_01_sfnt_off00009b2a.bind1c2a5ff9faa5c7990e30062f8fb1207fb7c4079c15697c93dbe0dd623c6e252 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9B2A | 5516 bytes |
font_02_sfnt_off0000adff.bindc12863fb92b17ba39b08bedf630ff6bab662d987c8de05854bb98a1fcbf0c5e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xADFF | 10088 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.