MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a mass of external links, many of which point to a link farm hosted on static.usrfiles.com. One of the embedded URLs, https://ttraff.me/wix?keyword=excel+pull+sheet+name+from+cell, is identified as a malicious redirector. The document body, though heavily obfuscated, contains references to this URL and other benign-looking PDF links, suggesting a social engineering attempt to drive traffic to the malicious redirector. The file was generated by wkhtmltopdf, which can be abused to create malicious documents.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=excel+pull+sheet+name+from+cell
- https://static.usrfiles.com/ugd/ea2f88_4c8eaad677c04cfeacc8c40a69a484e6.pdf
- https://static.usrfiles.com/ugd/ca32a8_8418c428bc6a46c8aead26d66a252321.pdf
- https://static.usrfiles.com/ugd/4fea5c_9f74fe64b8c6409d90f00ede1cf89b68.pdf
- https://static.usrfiles.com/ugd/e3ed1f_67a85a3e9c024f72bbc5194908e12618.pdf
- https://static.usrfiles.com/ugd/9f6a24_581bfa648fcc45dbbf02c35882fe29e6.pdf
- https://static.usrfiles.com/ugd/76b6de_9fd7810bfd5240d29a7297a17ae68b05.pdf
- https://static.usrfiles.com/ugd/111c46_3881837a59e4487a8649dbfb973ca420.pdf
- https://static.usrfiles.com/ugd/6cfc61_5365c3448bd243c9bc5495dbb913e8ae.pdf
- https://static.usrfiles.com/ugd/d13e1f_5be5d2c03ba04edcaba0ef3cf77952c5.pdf
- https://static.usrfiles.com/ugd/b444d4_805324034fe84aa49a6d875ec422b41a.pdf
- https://static.usrfiles.com/ugd/5ed537_9682e2bd69fa4b51a4ebca48a53d9313.pdf
- https://cdn.shopify.com/s/files/1/0430/4066/9849/files/she_was_already_dead_meme_template.pdf
- https://cdn.shopify.com/s/files/1/0434/4286/4294/files/thng_t_07_2020_tt_bltbxh.pdf
- https://cdn.shopify.com/s/files/1/0432/0333/0209/files/kutam.pdf
- https://cdn.shopify.com/s/files/1/0435/2992/8872/files/lua_switch_statement.pdf
- https://cdn.shopify.com/s/files/1/0428/5523/5740/files/tarapuwabonuxuzur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off000092c0.binf48535a7036d7395e1efab9a77a8fae65ac7fa9538a742c5ddc3f4dacc04952b |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x92C0 | 22240 bytes |
font_00_sfnt_off00005eab.binf2b9b5be5cb03350152cf1226edea523db94c826e27b82c7ff5fca2f08847e0e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5EAB | 5280 bytes |
font_01_sfnt_off0000707f.bin1ed114a801cf25b9884a18966d6fdf0b2466daf299f876cc6459875e59055210 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x707F | 9936 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.