MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure related to an 'angelus prayer pdf' and includes the malicious URL. This indicates a social engineering attempt to trick users into visiting a malicious site.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=angelus+prayer+pdf
- https://cdn.shopify.com/s/files/1/0434/2379/3308/files/raxuxalovexat.pdf
- https://cdn.shopify.com/s/files/1/0438/6629/2389/files/igcse_physics_paper_6_guide.pdf
- https://cdn.shopify.com/s/files/1/0437/4550/9537/files/toro_824_snowblower.pdf
- https://cdn.shopify.com/s/files/1/0435/9523/5490/files/17890848656.pdf
- https://cdn.shopify.com/s/files/1/0439/2439/0056/files/jiruxakujenegupozurifel.pdf
- https://cdn.shopify.com/s/files/1/0433/1382/3909/files/39589710657.pdf
- https://cdn.shopify.com/s/files/1/0438/6009/9222/files/rarupiwonawudozuped.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fejekav.pdf
- https://cdn.shopify.com/s/files/1/0433/6313/9733/files/23386744044.pdf
- https://cdn.shopify.com/s/files/1/0438/8667/4088/files/cadver_exquisito_agustina_bazterrica.pdf
- https://static.usrfiles.com/ugd/9b5f63_aca68ab62fa948458ff8fb09eda62b2a.pdf
- https://static.usrfiles.com/ugd/cc14e4_efbd0e24158c4a4ea2ff1802cb7de595.pdf
- https://static.usrfiles.com/ugd/b8c837_c5c3eec5cda04c8e9819206fed996b30.pdf
- https://static.usrfiles.com/ugd/d3758e_62023fd64792474ba926c2da78933212.pdf
- https://static.usrfiles.com/ugd/b8c837_2aa03b9f0ca9473d926d453b326addf1.pdf
- https://static.usrfiles.com/ugd/b8c837_ce4376c3d3a342f391a01856abd891d4.pdf
- https://static.usrfiles.com/ugd/8e1900_0feba203eea4467b98d44fd571fb4eb7.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000090e3.bin735fbd1f1ca80dc347b154751bd0a5bc5e27d819328ae506e1449927b92c4638 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x90E3 | 5300 bytes |
font_01_sfnt_off0000a303.binaa93139da7890f69c90f5e23dfbb7d14cc463bfd7e266ad9c47b0046b192d4a8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA303 | 11040 bytes |
font_02_sfnt_off0000c837.bind4dda1615a4364475d7d89fd1a7bbb7554fe073cd77351cd845804a7b4c90b1a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC837 | 16300 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.