Malware Insights
The PDF document contains a clear call-to-action to download software, which is a common lure for malicious content. The PDF_MALICIOUS_REDIRECTOR_LINK heuristic indicates that a primary URL redirects to malicious infrastructure, specifically `https://ttraff.com/wix?keyword=intericad+t6+free+download+for+pc%252Fmac+-+crack+incl`. The PDF_SEO_LINK_FARM heuristic suggests a large number of outbound links, many pointing to `static.usrfiles.com`, which is likely part of a link farm to improve search engine ranking for the malicious content. The document body contains text related to software cracking and download prompts.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=intericad+t6+free+download+for+pc%252Fmac+-+crack+incl
- https://cdn.shopify.com/s/files/1/0439/5030/9531/files/50588899167.pdf
- https://cdn.shopify.com/s/files/1/0459/2395/8935/files/pekag.pdf
- https://cdn.shopify.com/s/files/1/0432/3170/7294/files/50719099307.pdf
- https://static.usrfiles.com/ugd/b8c837_dc86ab8a4433493baa4009303d39af6d.pdf
- https://static.usrfiles.com/ugd/299074_0cebbd6c8de84646983b8f115e85916d.pdf
- https://static.usrfiles.com/ugd/07625c_2e88e3492dff4d4da52958de79279e9b.pdf
- https://static.usrfiles.com/ugd/b8c837_eed5214769894018ade179f2bcb6e221.pdf
- https://static.usrfiles.com/ugd/3eed2b_a7465ea6ed94438fb1ddfdc1773b76d7.pdf
- https://static.usrfiles.com/ugd/b8c837_ac398deca5044b7582632b355e49fdfb.pdf
- https://static.usrfiles.com/ugd/9219f8_ce8c1b1fe2344b48b38109f42428fe5c.pdf
- https://static.usrfiles.com/ugd/2813e2_bbbecbda26c74ef394dc7c8a08591cf4.pdf
- https://static.usrfiles.com/ugd/d17951_fd1cd35a768c4d96957540a50c9c6820.pdf
- https://static.usrfiles.com/ugd/49be48_8e1a37db9ee844adab792deeee071213.pdf
- https://static.usrfiles.com/ugd/7598fa_4aa40539c8ce49b48b9c19ed2b15b639.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005a66.binb7c99d96505f8a2f5da3ccacafcf4b31db7a367959fd497d4ce6007a2b19be63 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5A66 | 5224 bytes |
font_01_sfnt_off00006c26.binb6a0f020b5a0fc9004f3f245d9df384de254892f575e54946a755e8b7d78a4d7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6C26 | 9912 bytes |
font_02_sfnt_off00008e1f.bin4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E1F | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.