MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=2019+acura+rdx+android+auto+update'. Additionally, it exhibits characteristics of a PDF link farm, with numerous external links, one of which is 'https://static.usrfiles.com/ugd/ab059d_292c70ec6a0c4eaba16f2437c9095a1b.pdf'. The presence of a 'download button' heuristic further suggests a social engineering lure. The document body, though heavily corrupted, contains fragments of the malicious URL and other PDF links, reinforcing the attack pattern.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=2019+acura+rdx+android+auto+update
- https://static.usrfiles.com/ugd/ab059d_292c70ec6a0c4eaba16f2437c9095a1b.pdf
- https://static.usrfiles.com/ugd/ab059d_91dc0b5a44644941b08eb5e64c0a06d1.pdf
- https://static.usrfiles.com/ugd/e3834b_afa4bc73362f48479aba0c712dcdffec.pdf
- https://static.usrfiles.com/ugd/09c3c7_01f5359bb10d49ee9af5127552994358.pdf
- https://static.usrfiles.com/ugd/74e905_68f44cf91b3e4c6ea66462d14df6bb9d.pdf
- https://static.usrfiles.com/ugd/4fb05f_9b8a129e3ec24a63a3d505ec36040856.pdf
- https://static.usrfiles.com/ugd/c7ef1a_d76b38039584423fbe4177a43ae4d9ec.pdf
- https://cdn.shopify.com/s/files/1/0434/7396/1125/files/vimujabovonobexamosu.pdf
- https://cdn.shopify.com/s/files/1/0437/3161/5909/files/tidejikolowem.pdf
- https://cdn.shopify.com/s/files/1/0427/8488/2844/files/accredited_tier_designer.pdf
- https://cdn.shopify.com/s/files/1/0428/6378/8188/files/fikomidiba.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/96704933611.pdf
- https://cdn.shopify.com/s/files/1/0430/4227/5485/files/insanity_workout_online.pdf
- https://cdn.shopify.com/s/files/1/0432/4130/8319/files/income_support_client_reporting.pdf
- https://cdn.shopify.com/s/files/1/0431/2236/0481/files/65355392280.pdf
- https://cdn.shopify.com/s/files/1/0459/6206/8127/files/galvin_green_waterproof_jacket_size_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006268.bin29be92b7047b2572e1fc84a364a826f253be7bc81588ecda3e37b844492d9605 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6268 | 5312 bytes |
font_01_sfnt_off0000748c.bin172214084b3e9702d3506f6a6f28ed28640ea71ece74139432c87b613cc03628 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x748C | 10320 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.