MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links, with one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates a direct attempt to lead the user to harmful content via 'https://ttraff.com/pify?keyword=medicine+drugs+dictionary+pdf'. The 'PDF_SEO_LINK_FARM' heuristic further supports this by identifying a mass of external links, suggesting a coordinated effort to distribute malicious content or phish users.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=medicine+drugs+dictionary+pdf
- http://files.ngravinggifts.shop/uploads/1/3/0/7/130776016/9742951.pdf
- http://files.ipads4teaching.net/uploads/1/3/2/8/132814898/worawexisaxewen-gedofasisuwenu-febumezelob-rolokadexobuzop.pdf
- http://files.brandonmoorecomposition.com/uploads/1/3/1/4/131438766/muxigem.pdf
- http://files.auroraonfrance.com/uploads/1/3/1/4/131409037/masumukun_pakowaxaluxore.pdf
- http://files.brianduford.com/uploads/1/3/1/6/131606861/57a7297.pdf
- http://files.brandonmoorecomposition.com/uploads
- https://cdn.shopify.com/s/files/1/0434/0645/9032/files/30825097795.pdf
- https://cdn.shopify.com/s/files/1/0434/8539/7152/files/loluna.pdf
- https://cdn.shopify.com/s/files/1/0432/2987/2292/files/relubijikobobifopapag.pdf
- https://cdn.shopify.com/s/files/1/0437/1687/0309/files/35816260869.pdf
- https://cdn.shopify.com/s/files/1/0427/8986/3580/files/xezixeze.pdf
- https://cdn.shopify.com/s/files/1/0431/3592/6434/files/69817008666.pdf
- https://cdn.shopify.com/s/files/1/0430/2857/8467/files/rebulujoz.pdf
- https://cdn.shopify.com/s/files/1/0431/4100/5480/files/zapomomanezejotovuxasigew.pdf
- https://cdn.shopify.com/s/files/1/0431/8016/3227/files/67401846945.pdf
- https://cdn.shopify.com/s/files/1/0434/7199/5030/files/88539473857.pdf
- https://cdn.shopify.com/s/files/1/0431/0931/8813/files/49735920954.pdf
- https://cdn.shopify.com/s/files/1/0431/8609/4248/files/42332089438.pdf
- https://cdn.shopify.com/s/files/1/0437/8198/0317/files/juworekunixigilelu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000074c2.binb8b15549cd50b576f955d6f60100258c09c1813e436a43f97871adade5662fb7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x74C2 | 5280 bytes |
font_01_sfnt_off000086c6.bin5f41dd7de8ed64cc9d44bfe1ebb4e13f6f4c7d7a14ee73c397b13e8c2825698c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86C6 | 4376 bytes |
font_02_sfnt_off000092a7.bin77ed878db61c317de7e4acb5166f981abdf0e75cdc4c0e522be37555b0da1986 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x92A7 | 10428 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.