MALICIOUS
168
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious Link
T1566.002 Spearphishing Attachment
The PDF contains multiple heuristics indicating malicious intent, including a critical finding of a PDF redirector link to ttraff.ru and a PDF link farm. The presence of a 'SE_BROWSER_INSTALL_LURE' heuristic suggests a social engineering tactic to trick the user into installing something. The document body, though heavily obfuscated, contains the URL https://ttraff.ru/pify?keyword=netbeans+ide+c, which is flagged as a malicious redirector. This combination strongly suggests the document is designed to lead the user to a malicious site.
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=netbeans+ide+c
- https://static.usrfiles.com/ugd/b8c837_b6c190f4b6494997a8f83f845ef1045a.pdf
- https://static.usrfiles.com/ugd/b8c837_55766d608c5141be8a9b6785fb8ad384.pdf
- https://static.usrfiles.com/ugd/bd5c68_c659085df8b14699a7913d980522a26c.pdf
- https://static.usrfiles.com/ugd/d5d855_6c9f5f308a4b460a9a3956619be35a41.pdf
- https://static.usrfiles.com/ugd/b3bc21_22a9e8703ca6431fb9613c3afbc1e5e4.pdf
- https://static.usrfiles.com/ugd/fd3290_4e88449cf7c444f4a1e17b0926fb51e2.pdf
- https://static.usrfiles.com/ugd/0c41e7_ef4c86cb021943de930fdab1ddbee62f.pdf
- https://static.usrfiles.com/ugd/f55bec_925e6c4c1d2b4a8fb2f20539edb92e38.pdf
- https://static.usrfiles.com/ugd/b8c837_1a5f92b248f644aebb64990e07b4a0b4.pdf
- https://static.usrfiles.com/ugd/a31856_a0d183d12ac047979027525d733fee04.pdf
- https://static.usrfiles.com/ugd/fa32a6_06b5a067db6e474a8ac3bf998fb0ccab.pdf
- https://static.usrfiles.com/ugd/aa14a9_842b2f9cea594039a1bbc095458bebff.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000b157.bin0e3471eae5ce0818096814367f47f21d08ef8d8aa305a422b72979eb070fdbe8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB157 | 4912 bytes |
font_01_sfnt_off0000c220.bin1aa2a74c40b3c929cd8c969bec294fe43a588427f77ad684e161c6d8cf9df08c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC220 | 14156 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.