MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=the+asphalt+handbook'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, with the primary one being to a Shopify domain. The document body, though heavily obfuscated, contains references to the redirector URL and other PDF files hosted on Shopify. This suggests a social engineering attack aiming to redirect users to malicious content.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=the+asphalt+handbook
- https://cdn.shopify.com/s/files/1/0432/6876/7912/files/mukazekarizovif.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zonamanasalusowalu.pdf
- https://cdn.shopify.com/s/files/1/0429/4665/8463/files/acidosis_respiratoria_y_metabolica.pdf
- https://cdn.shopify.com/s/files/1/0431/6971/0242/files/the_collapse_of_the_roman_empire.pdf
- https://cdn.shopify.com/s/files/1/0431/7980/2782/files/dictionnaire_juridique_anglais_francais.pdf
- https://static.usrfiles.com/ugd/b8c837_aa573429fb52486d9ceffad07794d9fb.pdf
- https://static.usrfiles.com/ugd/b56239_b7d8ba586112479fb44905d3dc63ea4f.pdf
- https://static.usrfiles.com/ugd/b8c837_22813a1d775f470e99dea0f87da2c60b.pdf
- https://static.usrfiles.com/ugd/a382ee_38c5eb448ec94145b11346ed731877e1.pdf
- https://static.usrfiles.com/ugd/b8c837_f0ebfcabce4c4cf0a162a5a8fcf1f344.pdf
- https://static.usrfiles.com/ugd/b8c837_d7a5154abc534d9fb684c0cba3385b6e.pdf
- https://cdn.shopify.com/s/files/1/0433/4085/7494/files/805830081.pdf
- https://cdn.shopify.com/s/files/1/0432/3019/9966/files/reading_and_writing_skills_grade_11_deped.pdf
- https://cdn.shopify.com/s/files/1/0432/7306/0520/files/71636223803.pdf
- https://cdn.shopify.com/s/files/1/0432/2371/1903/files/vezajafadokaxofit.pdf
- https://cdn.shopify.com/s/files/1/0432/5782/3390/files/textbook_of_diagnostic_microbiology_mahon_free_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000047f9.bin32847a58d75b6f5bc5280163fe86c6c5a221666ce4ec0f94b531c255f98714e2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x47F9 | 4844 bytes |
font_01_sfnt_off0000585e.binb4a6ffaa2fe11aac664343a1fec2ec8bfdc23a30a68e7b36a508da6374607901 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x585E | 10060 bytes |
font_02_sfnt_off00007acc.bin9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7ACC | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.