MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links, many of which point to a redirector service. The primary malicious link, 'https://ttraff.link/wix?keyword=roll+of+galvanized+sheet+metal', is designed to lure users to potentially harmful content. The document body, though heavily obfuscated, contains references to this URL and other benign-looking PDF links, suggesting a link farm or redirection tactic to obscure the final malicious destination.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=roll+of+galvanized+sheet+metal
- https://static.usrfiles.com/ugd/590778_ffbbb91cec9a44efa03b69e165bf3373.pdf
- https://static.usrfiles.com/ugd/909b15_27eaeb8bd77844838e8d010866716a47.pdf
- https://static.usrfiles.com/ugd/93971e_f771af6acc5140f485501afbaad41700.pdf
- https://static.usrfiles.com/ugd/f67134_73986e827ebc4bdb978fc74673794b6e.pdf
- https://static.usrfiles.com/ugd/b8c837_d2fc01be6ca84681814b5d766f228403.pdf
- https://static.usrfiles.com/ugd/e7e4a0_4ad747e2996748168ffefb14935e000d.pdf
- https://static.usrfiles.com/ugd/e2c250_4a133ef7340b4662b69922931a9741d2.pdf
- https://static.usrfiles.com/ugd/b8c837_7a7bfa148a58420d9e372c99d0b7c051.pdf
- https://static.usrfiles.com/ugd/e948c1_5f863116712d48f2ac0f1c4266059fca.pdf
- https://static.usrfiles.com/ugd/270e53_4a80f2a22b7e471da0bd369f3ba968c5.pdf
- https://static.usrfiles.com/ugd/d31907_19f4bf6da41b4f1c815073525b4a714e.pdf
- https://static.usrfiles.com/ugd/b8c837_d628ed0e895649dd89fe66bc85ae17fc.pdf
- https://static.usrfiles.com/ugd/06497e_9e2aec37fe0f47b29a908be089682cf6.pdf
- https://static.usrfiles.com/ugd/035627_c9126a0c854f4aadb7c544a9bcb2abe8.pdf
- https://static.usrfiles.com/ugd/c068f8_cf3d3c8c05864ad89e4a39a69fc42045.pdf
- https://static.usrfiles.com/ugd/e4a001_e242ba21ff62449ab38fa3d8bfb64acb.pdf
- https://static.usrfiles.com/ugd/b8c837_a51bde549a4b435ea3aabcaf1a2a355d.pdf
- https://static.usrfiles.com/ugd/115d6e_c49240c1b1de499abb591174f88eed22.pdf
- https://static.usrfiles.com/ugd/61804c_7f8a38da65e24d02a37454141876f995.pdf
- https://static.usrfiles.com/ugd/04c368_9c517b4a6fda465da3938f222df59b1e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000067dd.bin7aa30edf115f77428e5d4a7bd0060b92ffd521f4d2ecd1e96d21c036dbc9c1f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x67DD | 5344 bytes |
font_01_sfnt_off000079fc.bin0aebe354e73544783c03fd5a4aae3da1d7e7b42686aa5cd987f65c0b605321e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x79FC | 15420 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.