MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains heuristics indicating it is a malicious redirector and uses an advance-fee scam lure. The document body, though heavily obfuscated, contains a URL that is also flagged as a malicious redirector. This suggests the document's primary purpose is to redirect the user to a malicious site, likely for phishing or further malware delivery.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/pify?keyword=looking+for+alaska+pdf+online
- https://site-1037844.mozfiles.com/files/1037844/sinaguwasadefowavibad.pdf
- https://site-1041292.mozfiles.com/files/1041292/28312234476.pdf
- https://site-1036977.mozfiles.com/files/1036977/fuxeniboxava.pdf
- https://site-1037187.mozfiles.com/files/1037187/8658243481.pdf
- https://site-1036939.mozfiles.com/files/1036939/mumijisupowemibunopax.pdf
- https://cdn.shopify.com/s/files/1/0481/4906/9991/files/nesiwesebitotogixivefupas.pdf
- https://cdn.shopify.com/s/files/1/0435/4496/9367/files/59762724543.pdf
- https://cdn.shopify.com/s/files/1/0481/6722/3445/files/50890055868.pdf
- https://cdn.shopify.com/s/files/1/0482/9963/8945/files/8155903069.pdf
- https://uploads.strikinglycdn.com/files/dee860f1-7864-4b4f-9ab7-fbbcf4e25e76/28558602936.pdf
- https://uploads.strikinglycdn.com/files/c23aae2d-c7bb-4563-b8da-744ffeb273e2/fepil.pdf
- https://uploads.strikinglycdn.com/files/57f16f9e-8e78-4a1b-97d4-bcb231d081de/90641510285.pdf
- https://uploads.strikinglycdn.com/files/4068e963-4063-4476-89ef-f6205a995a22/zunezuvapib.pdf
- https://cdn.shopify.com/s/files/1/0429/5576/7967/files/red_bottom_sneakers_price.pdf
- https://cdn.shopify.com/s/files/1/0432/3039/6574/files/53459312134.pdf
- https://cdn.shopify.com/s/files/1/0484/7524/2657/files/reloj_casio_vibration_alarm_manual.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004d8f7.bin5aeaf3931f5a49114dbf5ce51e8d2e043d65ae5f93267052840fcb37441372d2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D8F7 | 5212 bytes |
font_01_sfnt_off0004ead3.bin93f16d8364af9ba14cdcf49540d0a75eea15cea6bc22fa2860368ac29f930e5c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EAD3 | 12368 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.