MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file exhibits malicious behavior through a high density of embedded links, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM heuristics. One prominent URL, https://ttraff.cc/pify?keyword=psicologia+la+conducta+humana+jose+topf+pdf, appears to be a redirector. The document body, though heavily obfuscated, contains references to the same URLs, suggesting a coordinated effort to distribute content or redirect users to malicious sites. The presence of numerous Shopify-hosted PDF links further supports the SEO link farm characteristic.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=psicologia+la+conducta+humana+jose+topf+pdf
- http://besateru.kemuelroig.com/uploads/1/3/1/0/131071252/b4889a5.pdf
- http://files.headstart-getcap.org/uploads/1/3/0/8/130874683/2299308.pdf
- http://files.twincerelyyoursfw.com/uploads/1/3/1/8/131857213/2411703.pdf
- http://files.artsforactfineartauction.com/uploads/1/3/1/3/131380741/xaxunekefoxu_taxuzezitafe_nalamaw_moviwonab.pdf
- https://cdn.shopify.com/s/files/1/0433/0445/2246/files/vujamorexibexizetugepiwo.pdf
- https://cdn.shopify.com/s/files/1/0439/2042/5115/files/47216206023.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/wudivilijekeroleve.pdf
- https://cdn.shopify.com/s/files/1/0430/9359/0177/files/technical_support_interview_questions_and_answers_for_freshers.pdf
- https://cdn.shopify.com/s/files/1/0434/3519/6568/files/26778219900.pdf
- https://cdn.shopify.com/s/files/1/0432/5546/4104/files/53136919379.pdf
- https://cdn.shopify.com/s/files/1/0438/7880/9755/files/pilokovarixawokasolo.pdf
- https://cdn.shopify.com/s/files/1/0427/8353/9366/files/29661970197.pdf
- https://cdn.shopify.com/s/files/1/0430/1006/4537/files/99751397970.pdf
- https://cdn.shopify.com/s/files/1/0431/8245/7000/files/mozelozomugavumafotoli.pdf
- https://cdn.shopify.com/s/files/1/0436/3046/1081/files/data_structure_and_algorithm_made_easy_in_c.pdf
- https://cdn.shopify.com/s/files/1/0429/1864/1830/files/scrabble_letters_printable.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004a22.bin892d4c7b98e492c8284ef05b1cfd8e02e2615e47336a313a0e38528b941ef792 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4A22 | 5548 bytes |
font_01_sfnt_off00005ce5.bin3bc8c972bff0937ff8af05bc7ae1666ac19220e4f627db8762d423619acc632c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5CE5 | 10104 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.