MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded links, many of which point to external sites designed to host further malicious content. The document body, though partially corrupted, suggests a lure related to 'coloring workbook answers anatomy and physiology' to entice users to click the malicious links. The primary malicious link identified is https://ttraff.me/wix?keyword=coloring+workbook+answers+anatomy+and+physiology, which likely leads to further redirection or malware delivery.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=coloring+workbook+answers+anatomy+and+physiology
- http://refajilo.houseofgeekiness.com/uploads/1/3/2/3/132303382/963fa.pdf
- http://files.meaganedgar.com/uploads/1/3/1/6/131606094/02ea19cf3.pdf
- http://files.geophysical.eu/uploads/1/3/2/6/132682681/godatugojuj.pdf
- http://nudibojeg.ardingtonschoolofcrafts.com/uploads/1/3/0/7/130776889/4578245.pdf
- http://rokoker.railoun.com/uploads/1/3/2/6/132681946/2564840.pdf
- https://cdn.shopify.com/s/files/1/0432/2168/0283/files/elatus_era_safety_data_sheet.pdf
- https://cdn.shopify.com/s/files/1/0430/7383/1072/files/wedumariwalarivum.pdf
- https://cdn.shopify.com/s/files/1/0434/0734/3772/files/movixobabepofejukezoza.pdf
- https://cdn.shopify.com/s/files/1/0454/3751/7982/files/dafutisowopixuxuzevupowir.pdf
- https://cdn.shopify.com/s/files/1/0428/5153/2963/files/haryana_police_annexure_e1_form.pdf
- https://cdn.shopify.com/s/files/1/0432/4104/6171/files/30043394949.pdf
- https://cdn.shopify.com/s/files/1/0427/6636/8935/files/muguzasovile.pdf
- https://cdn.shopify.com/s/files/1/0434/5259/6374/files/tesujidak.pdf
- https://e7ad12dc-90e7-42cc-a0f3-5852ad193cf3.filesusr.com/ugd/7a13df_ee4be3df8642429d9464d47bd9a6d9e0.pdf?index=true
- https://a9e2ccfa-4f61-4692-bb3b-4de6a9b6b681.filesusr.com/ugd/d17951_19b704671c5d415c812b9fea53e780f6.pdf?index=true
- https://475ba9ae-2147-437b-8745-a49489be4a80.filesusr.com/ugd/7d1dc9_78a8431a10fe45ab82d9f27dfe7263f0.pdf?index=true
- https://6bb88ffd-12d0-430a-8bcf-316d4a49f299.filesusr.com/ugd/17beed_d8a1f15de5a14142b20db3810d3a770f.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007153.binaadb33beab8275a6b445a06d4bc408e62cb3dbfac7e715d073dd26e27ddc8aeb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7153 | 5676 bytes |
font_01_sfnt_off00008484.bin805af654105872be2e5f97ece7a37e6e835bc5792558ec4d7b3ae8901ff98804 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8484 | 10312 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.