MALICIOUS
168
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF contains multiple embedded URLs, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text that, combined with heuristic findings, suggests an advance-fee scam lure. The primary malicious URL is ttraff.ru, which redirects to a page related to a 'gentleman's guide'. The presence of numerous Shopify links, while benign, is likely part of a link farm to improve SEO for the malicious content.
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=gentleman%2527+s+guide+original+cast
- http://sejonuva.jessdoinglife.com/uploads/1/3/2/6/132682663/zuvukukivutut.pdf
- https://cdn.shopify.com/s/files/1/0433/0458/3318/files/how_to_improve_creative_writing_skills_in_english.pdf
- https://cdn.shopify.com/s/files/1/0432/7541/9798/files/27267643283.pdf
- https://cdn.shopify.com/s/files/1/0437/0428/7383/files/star_ocean_anamnesis_awakening_guide.pdf
- https://cdn.shopify.com/s/files/1/0438/6154/1014/files/manualidades_con_material_reciclable_paso_a_paso.pdf
- https://cdn.shopify.com/s/files/1/0431/9094/3902/files/16843578184.pdf
- https://cdn.shopify.com/s/files/1/0429/2712/8735/files/animation_maker_android_app.pdf
- https://cdn.shopify.com/s/files/1/0430/6577/0135/files/trail_guide_to_the_body_download.pdf
- https://cdn.shopify.com/s/files/1/0438/8945/9368/files/guided_reading_lesson_plan_template_kindergarten.pdf
- https://cdn.shopify.com/s/files/1/0431/5011/4965/files/syntactic_structures_by_noam_chomsky.pdf
- https://cdn.shopify.com/s/files/1/0440/8901/6472/files/graham_fuller_arap_bahar_ve_trkiye.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000933c.binf3b558416090c3b0e0c94a00111dbb9a8518c5aab9c7a6295b953006aa86b833 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x933C | 5324 bytes |
font_01_sfnt_off0000a544.bindabbe03c108d287bedb45394e50cd46f47786dc183e0a172eeab3a6677d410a2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA544 | 10420 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.