MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The embedded URL https://ttraff.ru/pify?keyword=chess+apps+for+android+best is a primary indicator of this malicious redirection. The document body, though partially corrupted, contains references to this URL and other Shopify links, suggesting a lure to external content. The ML classifier strongly supports the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=chess+apps+for+android+best
- http://files.bagribybagri.com/uploads/1/3/2/6/132680986/1780476.pdf
- http://files.cyclebavaria.com/uploads/1/3/0/7/130775200/xuzolizatelirapabak.pdf
- http://files.daydreamscakecompany.com/uploads/1/3/0/7/130739919/8fb06e9434.pdf
- http://files.allstarscomedyentertainment.com/uploads/1/3/0/7/130740391/gujiwewugip-riwanixivoli-xezebito-vaxegokasinaze.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nifafujejugafux.pdf
- https://cdn.shopify.com/s/files/1/0433/6674/4216/files/ipad_annotation_app_reddit.pdf
- https://cdn.shopify.com/s/files/1/0441/1041/3976/files/penodirofowegokiburepe.pdf
- https://cdn.shopify.com/s/files/1/0429/4773/9811/files/37421479033.pdf
- https://cdn.shopify.com/s/files/1/0432/6971/8172/files/domejepizorejik.pdf
- https://cdn.shopify.com/s/files/1/0439/8612/4958/files/simezula.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/88065476392.pdf
- https://cdn.shopify.com/s/files/1/0444/4153/4631/files/pangu_9._0._2_jailbreak.pdf
- https://cdn.shopify.com/s/files/1/0431/6109/2255/files/99333497232.pdf
- https://cdn.shopify.com/s/files/1/0432/2351/5294/files/luxubusisepu.pdf
- https://cdn.shopify.com/s/files/1/0432/3583/6072/files/merosulesapowifuvajoz.pdf
- https://cdn.shopify.com/s/files/1/0436/0873/5907/files/push_code_to_heroku.pdf
- https://cdn.shopify.com/s/files/1/0433/2378/5370/files/ziluzo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006b5d.bindc5b620a5d1fad05cdd840fc5188a12d9e05fbbab88b5fd3380cdc0acaaeff37 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B5D | 5140 bytes |
font_01_sfnt_off00007cc6.bin24a9e8abebc841842906b2284f8664c4206a539b50f9760ce8be4487632b9bc0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7CC6 | 9740 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.