MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though partially corrupted, includes text related to 'Baillie gifford global discovery fund performance', suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, including one that leads to a Shopify domain. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to a malicious site.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=baillie+gifford+global+discovery+fund+performance
- http://files.pink-halo.org/uploads/1/3/0/8/130813381/7794329.pdf
- http://files.allanimalclinichattiesburg.com/uploads/1/3/0/7/130775299/venipedek.pdf
- http://vewituvup.stonechenlab.org/uploads/1/3/2/6/132695306/wilejoxaviralat_juwivupo_bekepotano_visasaz.pdf
- http://doxokodif.infantmassagenewzealand.org/uploads/1/3/0/8/130814328/75dce4e620fd2.pdf
- http://files.amhuff.com/uploads/1/3/2/6/132681359/974be3323.pdf
- https://cdn.shopify.com/s/files/1/0427/9648/2727/files/79680787192.pdf
- https://cdn.shopify.com/s/files/1/0450/8762/1283/files/solving_systems_of_equations_algebraically_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0440/4445/2005/files/best_pvp_class_6._2.pdf
- https://cdn.shopify.com/s/files/1/0430/9689/9733/files/tn_bill_of_sale_for_car.pdf
- https://cdn.shopify.com/s/files/1/0431/6997/2384/files/bhagavad_gita_sadhak_sanjivani_english_download.pdf
- https://cdn.shopify.com/s/files/1/0431/7973/7237/files/rofomimita.pdf
- https://cdn.shopify.com/s/files/1/0428/1401/3606/files/lojodoxorif.pdf
- https://cdn.shopify.com/s/files/1/0436/1791/0941/files/51415807175.pdf
- https://cdn.shopify.com/s/files/1/0429/9476/1877/files/95178081877.pdf
- https://cdn.shopify.com/s/files/1/0427/6004/4710/files/2613935667.pdf
- https://cdn.shopify.com/s/files/1/0430/4017/8333/files/how_to_compress_file.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006180.bin6f6c726b0207aa3590e560af0fb1388109df322c436a537d1978ec78fcf03adb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6180 | 5628 bytes |
font_01_sfnt_off0000748a.binaca372b616dd22f95efcfc2c3d5e80d37dfc1474c6d3f273c4d69d96cba53405 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x748A | 10032 bytes |
font_02_sfnt_off000096db.bin7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x96DB | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.