MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=arcane+mage+guide+8.+1.+5'. This indicates the document's primary purpose is to redirect users to a potentially harmful site. Additionally, a PDF SEO link farm heuristic was triggered, suggesting the PDF is part of a larger scheme to generate traffic or distribute content via numerous external links, with 'https://cdn.shopify.com/s/files/1/0435/1164/4324/files/27470987389.pdf' being one of the linked benign URLs.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=arcane+mage+guide+8.+1.+5
- https://cdn.shopify.com/s/files/1/0435/1164/4324/files/27470987389.pdf
- https://cdn.shopify.com/s/files/1/0434/1573/2381/files/araba_yar_3d_apk.pdf
- https://cdn.shopify.com/s/files/1/0435/0833/4751/files/85123946113.pdf
- https://cdn.shopify.com/s/files/1/0429/5337/5897/files/98183634592.pdf
- https://cdn.shopify.com/s/files/1/0454/2958/8124/files/bodum_coffee_grinder_manual.pdf
- https://cdn.shopify.com/s/files/1/0437/5887/8872/files/luzifetubaw.pdf
- https://cdn.shopify.com/s/files/1/0432/1381/5966/files/52386956931.pdf
- https://cdn.shopify.com/s/files/1/0428/4642/1158/files/nod_32_seriales.pdf
- https://static.usrfiles.com/ugd/902d29_d372fc7efa1142cf95aeef6020154d91.pdf
- https://static.usrfiles.com/ugd/b8c837_4364837c90e34bed80cf35080e482e5a.pdf
- https://static.usrfiles.com/ugd/b8c837_2e9be0217a2c438ca5ca0ecfe9722218.pdf
- https://static.usrfiles.com/ugd/e32576_333b52c1c1f84bfe91068963a0c880c6.pdf
- https://static.usrfiles.com/ugd/fac845_75be5428b28b406ca24b95732ba05093.pdf
- https://static.usrfiles.com/ugd/824332_f78336baced74299bc95d18885274903.pdf
- https://static.usrfiles.com/ugd/d99ef3_c984156afdb34c148f5477c95285b496.pdf
- https://static.usrfiles.com/ugd/4dd980_6d2a0b75ded942f6a8a85b3b702c3ecb.pdf
- https://static.usrfiles.com/ugd/b8bbd7_f967bee21c634d18a96b0eb45ec00140.pdf
- https://static.usrfiles.com/ugd/87ad98_2a93089d228547918f0eb669114c9d21.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008124.bin7e784de544da70e7fbe3e6ca4e8a19447a7054e6505752394eedcc9d1f42972f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8124 | 5132 bytes |
font_01_sfnt_off0000926f.bina945eb633e0defc9fdbadd07a2217fd646eb792d2d7e10eeeeb5ad206b13ec4c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x926F | 10792 bytes |
font_02_sfnt_off0000b745.binff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB745 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.