MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was identified as malicious due to its inclusion of a link farm. The primary URL, https://ttraff.ru/wix?keyword=yu+gi+oh+225+b%25C3%25B6l%25C3%25BCm+izle, is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and appears to be a lure related to 'Yu gi oh' content, likely to entice clicks. The presence of numerous external links, many pointing to benign Shopify domains, suggests a tactic to obscure the malicious redirector or to appear as a legitimate content aggregator.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=yu+gi+oh+225+b%25C3%25B6l%25C3%25BCm+izle
- https://static.usrfiles.com/ugd/b8c837_40d1519768de4423a4f0c07f2cd1766f.pdf
- https://static.usrfiles.com/ugd/9cc572_bf3cecd54c054d3698924fafac09a8e2.pdf
- https://static.usrfiles.com/ugd/09273f_077d54363b0b4a839250942232cf9b98.pdf
- https://static.usrfiles.com/ugd/b8c837_93df851ba33a428ba21dde46959a3e73.pdf
- https://static.usrfiles.com/ugd/3b7182_83c2d3a4b7fe47769f139b3912da1ba1.pdf
- https://cdn.shopify.com/s/files/1/0437/8905/8206/files/essay_brainstorming.pdf
- https://cdn.shopify.com/s/files/1/0431/8996/0865/files/54895183182.pdf
- https://cdn.shopify.com/s/files/1/0429/2653/8911/files/learn_cryptocurrency_trading.pdf
- https://cdn.shopify.com/s/files/1/0433/4243/0362/files/61787879478.pdf
- https://cdn.shopify.com/s/files/1/0435/5565/1743/files/93691064218.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/rajijabobuzev.pdf
- https://cdn.shopify.com/s/files/1/0427/9874/3719/files/41045618115.pdf
- https://cdn.shopify.com/s/files/1/0428/2341/8019/files/bromatologia_de_alimentos.pdf
- https://cdn.shopify.com/s/files/1/0436/2544/7587/files/kemaduwavulujasefuv.pdf
- https://cdn.shopify.com/s/files/1/0430/8012/2532/files/2648976710.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007597.bin908a162c36e39cded3e4acf82c1ac6c30ae5f8d60715bd10fb3c21e6b3889d95 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7597 | 4900 bytes |
font_01_sfnt_off000086a9.bin9c4126ac2077b420b298e9a7d6de1694b67dfb59fa785b6e8a72ecb28d1fc11e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86A9 | 5280 bytes |
font_02_sfnt_off0000981c.binc8f7353c566fb474f44480c44342357561b7374b6934fed9411f6bedf988c252 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x981C | 11464 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.