MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on various platforms. One of the primary links, 'https://ttraff.link/123?keyword=polity+ncert+notes+for+upsc+pdf', is identified as a malicious redirector. The document body, though partially corrupted, contains text related to UPSC exam notes, suggesting a lure to attract users to click the malicious link under the guise of educational content. The presence of numerous SEO-optimized links further indicates an attempt to distribute malicious content widely.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/123?keyword=polity+ncert+notes+for+upsc+pdf
- https://lanasasaf.weebly.com/uploads/1/3/0/8/130815311/4287755.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/4867245.pdf
- https://ziripovopibew.weebly.com/uploads/1/3/0/8/130874468/2017451.pdf
- https://dudikojegak.weebly.com/uploads/1/3/1/4/131406444/77694823b2d8e.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/rotizizalipi-xulejowo-wegevok-xutijub.pdf
- https://cdn-cms.f-static.net/uploads/4366045/normal_5f873c41551b3.pdf
- https://cdn-cms.f-static.net/uploads/4374199/normal_5f8a5b9eef296.pdf
- https://cdn-cms.f-static.net/uploads/4366381/normal_5f8713162ac88.pdf
- https://cdn-cms.f-static.net/uploads/4367313/normal_5f88d47d92d43.pdf
- https://cdn-cms.f-static.net/uploads/4375531/normal_5f897c7d1564b.pdf
- https://cdn-cms.f-static.net/uploads/4374954/normal_5f89fc2cd0825.pdf
- https://cdn-cms.f-static.net/uploads/4366014/normal_5f881a8e2b823.pdf
- https://cdn-cms.f-static.net/uploads/4367310/normal_5f8a9ce99a367.pdf
- https://cdn-cms.f-static.net/uploads/4368977/normal_5f8a4a265edeb.pdf
- https://cdn-cms.f-static.net/uploads/4370299/normal_5f8827ad80bbc.pdf
- https://cdn-cms.f-static.net/uploads/4369518/normal_5f88c5888cfb1.pdf
- https://cdn-cms.f-static.net/uploads/4369519/normal_5f8aa545e3d74.pdf
- https://uploads.strikingly
- https://uploads.strikinglycdn.com/files/10e1c9f1-882e-4aed-b290-e4391eb7b751/kumagir.pdf
- https://uploads.strikinglycdn.com/files/ee118653-85ba-4431-8cac-91f3284a71bf/cursive_practice_sheets_make_your_own.pdf
- https://uploads.strikinglycdn.com/files/685b99a1-cc71-426e-9d44-e7f976b0032f/debafa.pdf
- https://uploads.strikinglycdn.com/files/fd172f75-9aa1-48f2-a5c1-a016366987a4/golunikelojemap.pdf
- https://uploads.strikinglycdn.com/files/e3492047-f34a-46d2-a76c-3ad42129b608/derecho_civil_mexicano_rojina_villegas.pdf
- https://uploads.strikinglycdn.com/files/928b4388-81d5-481c-bcc0-33f822d857da/kyocera_dura_xv.pdf
- https://uploads.strikinglycdn.com/files/3ca327ce-0ff2-4097-83c0-245b8fa258c5/10238670623.pdf
- https://uploads.strikinglycdn.com/files/e0a6587f-5fe9-45d8-918d-bd71b7a78a84/mojepasegivovuvuf.pdf
- https://uploads.strikinglycdn.com/files/b8ec7269-b382-4dd2-949a-3bdf02fa3fa9/vorigesoxaxopurede.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006a6e.bin0b8d53a178ea598078090a354f803f8cbe4a06217682e10c828316f5afe7f303 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A6E | 5044 bytes |
font_01_sfnt_off00007ba4.bin3359c5e1ddf82766ab3b333348e2fa1541ce475e965a71a49fc30f264b09b2d2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BA4 | 9996 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.