MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged for containing a large number of external links, a technique often used for SEO manipulation or to host malicious content. One of the embedded URLs, https://ttraff.com/wix?keyword=itw+signode+strapping+machine+manual, is identified as a known malicious redirector. The document body contains garbled text but also includes the same URL, suggesting it is intentionally placed.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=itw+signode+strapping+machine+manual
- https://cdn.shopify.com/s/files/1/0433/2145/8853/files/77306382397.pdf
- https://cdn.shopify.com/s/files/1/0429/6137/1290/files/fivamiterokatolulapiso.pdf
- https://cdn.shopify.com/s/files/1/0435/9559/5938/files/carvin_b2000_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0432/9907/8304/files/75054005942.pdf
- https://cdn.shopify.com/s/files/1/0428/8898/6787/files/filobapurizu.pdf
- https://7686ab3c-b75f-4b70-8e9c-0ca458a6c69d.filesusr.com/ugd/856cea_f71c47a32e9c4394b14ad8a735b17db7.pdf?index=true
- https://5ac46288-3057-47f9-93cb-f9116e779109.filesusr.com/ugd/aef5b7_e245803b8b1c4bb48c9706064273bbf9.pdf?index=true
- https://29113f29-e4bf-4311-97a7-8bb0ef240820.filesusr.com/ugd/805d2a_1596723bd04647648450216f623f602d.pdf?index=true
- https://671a7743-45a7-40ce-a866-f543362a09ed.filesusr.com/ugd/3b6424_bf18295ee9724dfea9e2ce2d843af7f7.pdf?index=true
- https://c57d3d26-f884-409f-b197-7b2eea48307e.filesusr.com/ugd/f5a024_2a7efd7a28bb428bb6eff3c202347b4c.pdf?index=true
- https://747f4dbb-9d54-4be7-972d-dcf4679f9c1b.filesusr.com/ugd/0fdb6d_a918d599aed2418484b7dcf94510bb46.pdf?index=true
- https://f88b42d3-5827-4cd5-bd68-3ea3ec0f386e.filesusr.com/ugd/4ca7f5_bbee0deec9e6462fa9402877b6fe0bc1.pdf?index=true
- https://0eb77b44-dedc-494f-a827-3780f4730d13.filesusr.com/ugd/668a47_9cf7abe7c6be4a9aa21f98dc2cc8d8b8.pdf?index=true
- https://dc12037a-feb4-4166-891d-2b201e2ce16a.filesusr.com/ugd/f96b02_10d7ca8969e74b91bfa7892f1e164912.pdf?index=true
- https://b497995c-37d8-425f-820b-fdeeaeacd966.filesusr.com/ugd/15cd4d_d62788f0ca454b55be4df3d1265549c6.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010d2f.bin3dbf95cb842a9b6ceda812fe1acd21f426d774f0c8d989b7c10c09e06e1f8f79 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D2F | 5400 bytes |
font_01_sfnt_off00011f65.bin26a250737e9ec573da52c36af8d75176897c5ceefbedfb12bd360c3d1e4a901a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F65 | 10632 bytes |
font_02_sfnt_off0001438e.bin9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1438E | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.