MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a high number of external links, many of which point to a redirector service. One such link, 'https://ttraff.me/wix?keyword=cesar+chavez+movie+worksheet', is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it is the primary lure. The presence of a 'download button' heuristic further supports a social engineering attack aimed at tricking the user into clicking the malicious link.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=cesar+chavez+movie+worksheet
- https://static.usrfiles.com/ugd/9bd82e_9f456732d7934966b64be631b9de38d3.pdf
- https://static.usrfiles.com/ugd/e2a635_7fbde733f0d24e139f33b7383af088a1.pdf
- https://static.usrfiles.com/ugd/565485_471154754bc941649f5323297b9ad3a3.pdf
- https://static.usrfiles.com/ugd/b8c837_4ba776081e1a4b24b12f870d08ffc894.pdf
- https://static.usrfiles.com/ugd/e3c460_4108dbd01d8e40c49b7c74259636858f.pdf
- https://static.usrfiles.com/ugd/a86d68_abfaec943c8241eba4faf127e6d31827.pdf
- https://static.usrfiles.com/ugd/9b33c5_8b270677b11346db97eff5480336bbbc.pdf
- https://static.usrfiles.com/ugd/a6e5e9_5c7cfe4136854e85b9826c7242fb8ff9.pdf
- https://static.usrfiles.com/ugd/0aab01_c75e0f5e33094ac4b60651791fc10a25.pdf
- https://cdn.shopify.com/s/files/1/0437/5835/4584/files/download_aptitude_math_shortcut_formulas.pdf
- https://cdn.shopify.com/s/files/1/0429/5272/0543/files/mutagiput.pdf
- https://cdn.shopify.com/s/files/1/0432/6863/6834/files/windows_media_center_guide_not_updating_2017.pdf
- https://cdn.shopify.com/s/files/1/0437/4321/5767/files/airlift_song_download.pdf
- https://cdn.shopify.com/s/files/1/0432/8184/2341/files/flowers_for_algernon_questions.pdf
- https://cdn.shopify.com/s/files/1/0434/7586/1656/files/i_love_dad_with_the_very_hungry_caterpillar.pdf
- https://cdn.shopify.com/s/files/1/0431/4251/2802/files/pevesu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b0b8.bin026b959a4cbdedeb8f8adbaf9de852848f69394a497fd7cfa6350ceede84c63b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB0B8 | 4976 bytes |
font_01_sfnt_off0000c1bd.bin294de37230f9c0ad5b9b7d4d0659b019704003fdd502e0917c1a4a5f92758e9a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC1BD | 10308 bytes |
font_02_sfnt_off0000e50f.bincd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE50F | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.