MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.me/wix?keyword=lewis+capaldi+songs+free'. This URL is presented within the document body, disguised as a free download for popular music, indicating a social engineering lure. The PDF also contains a large number of embedded links, many of which point to static.usrfiles.com, suggesting a link farm designed to obscure the malicious destination. The ML classifier strongly supports the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=lewis+capaldi+songs+free
- https://static.usrfiles.com/ugd/b8c837_ac8ba9cb165b40049bd01e7c91be5b7c.pdf
- https://static.usrfiles.com/ugd/e2f7e1_3f70ff333682499894e14c376204e81a.pdf
- https://static.usrfiles.com/ugd/b8c837_02fcd7a8c76540ff8357d32089e30245.pdf
- https://static.usrfiles.com/ugd/b8c837_4599b1e1f34d4d9885625c493d52c647.pdf
- https://static.usrfiles.com/ugd/d1d005_643c487b9a2146b39407e13340ab630d.pdf
- https://static.usrfiles.com/ugd/df4650_4d8de9eec4b54eac9054e77d436cf0e1.pdf
- https://static.usrfiles.com/ugd/60933b_4571d906664f49c2b13d7196c66de4ef.pdf
- https://static.usrfiles.com/ugd/0e9fc2_436e2b443e2041cd9c16c35a5a52abef.pdf
- https://static.usrfiles.com/ugd/b8c837_2d89d6439cac4a22ace7d31827e05513.pdf
- https://static.usrfiles.com/ugd/3ce946_06f94170d2254795accf75278e90582d.pdf
- https://static.usrfiles.com/ugd/b8c837_a973b37b504147cd9253f887e3dad7d3.pdf
- https://static.usrfiles.com/ugd/9edd50_ade62cd7c1204e2bb8eea0c46d63ea75.pdf
- https://static.usrfiles.com/ugd/47b1e8_201c8af0fc6b4b188105a785cb32500a.pdf
- https://static.usrfiles.com/ugd/b8c837_dbef19994c02481a98afd43b7786c9c2.pdf
- https://static.usrfiles.com/ugd/b88e3d_140ed65099db4ccfa87df2327ad4d02f.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/61047377128.pdf
- https://cdn.shopify.com/s/files/1/0435/2363/7399/files/44625848843.pdf
- https://cdn.shopify.com/s/files/1/0428/1060/5735/files/65235588577.pdf
- https://cdn.shopify.com/s/files/1/0440/6181/9045/files/wofofatobutefikefa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004d2b.bin35f14df505ddd0b30606d0d0990c9d5234d9b86e5d6618466cc56c80b8c0b849 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D2B | 5356 bytes |
font_01_sfnt_off00005f8b.bin99d532dc35acc46a6aa80270a820280b696a86a81d5762255d2a69136f4c6e73 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5F8B | 10292 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.