MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, suggesting a link farm for SEO poisoning. One critical heuristic identified a link to a known malicious redirector at `https://ttraff.club/wix?keyword=direct+and+reported+speech+worksheet+pdf`. The ML classifier also strongly indicated maliciousness. The document body text, though garbled, contains the phrase 'Direct and reported speech worksheet pdf', likely a lure to encourage clicks on the embedded links.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=direct+and+reported+speech+worksheet+pdf
- https://cdn.shopify.com/s/files/1/0431/1256/2849/files/lejerejugigeza.pdf
- https://cdn.shopify.com/s/files/1/0429/7300/3935/files/princess_coloring_sheets_online.pdf
- https://cdn.shopify.com/s/files/1/0433/4433/0905/files/miwagemewabelezedomew.pdf
- https://cdn.shopify.com/s/files/1/0433/7745/9363/files/32098381611.pdf
- https://static.usrfiles.com/ugd/d78803_281a9dc0f169496eb7b98590a422ed47.pdf
- https://static.usrfiles.com/ugd/bae363_b9e4cd41ba5b42d6bb10610e1e2ad183.pdf
- https://static.usrfiles.com/ugd/3b5dd9_1ff099c0bebb49cd89991496318ab996.pdf
- https://static.usrfiles.com/ugd/e3325f_0ad48c6f5fa44341a03a60f20131c875.pdf
- https://static.usrfiles.com/ugd/3e9e83_0b8c647be0bc4e8a80416e1e0a99069f.pdf
- https://cdn.shopify.com/s/files/1/0437/4603/3818/files/property_appraisal_report.pdf
- https://cdn.shopify.com/s/files/1/0432/1122/7300/files/85961590413.pdf
- https://cdn.shopify.com/s/files/1/0434/2956/0486/files/30025921262.pdf
- https://cdn.shopify.com/s/files/1/0439/4136/3870/files/sweating_bullets_guitar_tab.pdf
- https://cdn.shopify.com/s/files/1/0429/8365/3535/files/40207652239.pdf
- https://cdn.shopify.com/s/files/1/0429/1395/6007/files/10_rights_of_medication_administration.pdf
- https://cdn.shopify.com/s/files/1/0428/7247/1718/files/47162240602.pdf
- https://cdn.shopify.com/s/files/1/0463/8572/5595/files/kupigadurekedezowiz.pdf
- https://cdn.shopify.com/s/files/1/0427/8868/3932/files/55214865773.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006501.binc43d556549f0629ca28c3bba266053b2310525c9e1b1dd0f86f8da994c1e7a96 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6501 | 5368 bytes |
font_01_sfnt_off00007758.bin938126bf7443228948713dead883f1851eac1c3bf7b63edd0a0a55a4f011c78d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7758 | 10428 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.