MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file was flagged as malicious by an ML classifier and contains a link to a known malicious redirector. The document body, though heavily obfuscated, contains the same redirector URL. The presence of numerous external links, many pointing to static.usrfiles.com, suggests a link farm or redirection strategy. The primary malicious IOC is the ttraff.club URL, which is likely the initial stage of a phishing or malware delivery chain.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=wiggle+freeze+line+dance+step+sheet
- https://static.usrfiles.com/ugd/b8c837_1fbe7438b0204febb7cdcfe7cc1f4c31.pdf
- https://static.usrfiles.com/ugd/dc8a8e_c20edda1e6b443e8abfd20e3429adb7e.pdf
- https://static.usrfiles.com/ugd/ae059d_2b1a09c1fe6d4502acb469c6bae57000.pdf
- https://static.usrfiles.com/ugd/05900a_a4986a043f1f491eb3a1dd58855c5f52.pdf
- https://static.usrfiles.com/ugd/fe83c3_fa6f7607cdb54636b069bc645f955744.pdf
- https://static.usrfiles.com/ugd/12745a_4bda62a4acc847a1b9188533870a7898.pdf
- https://static.usrfiles.com/ugd/345929_60b0277a4fcf4dde807c38c2d062fef6.pdf
- https://static.usrfiles.com/ugd/3b5dd9_2d0419fba69e46d88a5e5365e976e24f.pdf
- https://static.usrfiles.com/ugd/7603ae_d90150e595aa4dc18fd8a8273472c078.pdf
- https://cdn.shopify.com/s/files/1/0428/3485/4051/files/list_of_common_logical_fallacies.pdf
- https://cdn.shopify.com/s/files/1/0462/4138/2560/files/pakistan_baitulmal_scholarship_form.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005a42.bine36263cf05f33c4f7b693a6ea679dbf62b63f50663bdb9503fda6e485d653fc8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5A42 | 5160 bytes |
font_01_sfnt_off00006bd9.binc4deeee9d9895775c718fb55c2141ae0da67cc4560377e65976e989db174eb7b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6BD9 | 12360 bytes |
font_02_sfnt_off00009405.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9405 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.