MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous embedded links, with one pointing to a known malicious redirector (ttraff.com). The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting an attempt to manipulate search engine results or host malicious content. The primary malicious URL identified is https://ttraff.com/wix?keyword=derecho+constitucional+unam. The document body is heavily obfuscated and contains binary data, making its direct content analysis impossible.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=derecho+constitucional+unam
- https://cdn.shopify.com/s/files/1/0437/8846/8376/files/tewire.pdf
- https://cdn.shopify.com/s/files/1/0457/4599/5932/files/48240369042.pdf
- https://cdn.shopify.com/s/files/1/0432/6352/5029/files/57284058569.pdf
- https://cdn.shopify.com/s/files/1/0434/3519/6566/files/meningitis_por_candida_albicans.pdf
- https://cdn.shopify.com/s/files/1/0435/6459/7397/files/alcoholism_test.pdf
- https://cdn.shopify.com/s/files/1/0435/2278/5444/files/weridu.pdf
- https://cdn.shopify.com/s/files/1/0432/9242/6405/files/24270263375.pdf
- https://cdn.shopify.com/s/files/1/0433/3184/6296/files/wagepipu.pdf
- https://cdn.shopify.com/s/files/1/0438/6209/8085/files/butomejimexipuda.pdf
- https://cdn.shopify.com/s/files/1/0434/6481/8838/files/algebra_ii_textbook.pdf
- https://cdn.shopify.com/s/files/1/0428/5949/5590/files/54572628284.pdf
- https://cdn.shopify.com/s/files/1/0435/8370/1151/files/round_function_python.pdf
- https://cdn.shopify.com/s/files/1/0438/9801/1816/files/zufuwixowavoloxoromik.pdf
- https://cdn.shopify.com/s/files/1/0428/2348/3548/files/57559470153.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zogubarekerebadopotuleju.pdf
- https://static.usrfiles.com/ugd/9757e7_2b1fe4cd75774bb7882e986bd00c802b.pdf
- https://static.usrfiles.com/ugd/136d07_2869acae690a475dacefa2793f10b0fb.pdf
- https://static.usrfiles.com/ugd/b8c837_9fc9a486b9604967a546ce3f8cd15726.pdf
- https://static.usrfiles.com/ugd/ed64d2_ee456ac832fb4aceb704474d6ff895d4.pdf
- https://static.usrfiles.com/ugd/b8c837_86b3e735cce247c796b4d063db64c3de.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004d67.bin93b3484c1e67019250380de01b38e25b0c6445f271d9594e09a82ca02a1c2691 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D67 | 5036 bytes |
font_01_sfnt_off00005e59.bin0de564d7ab770b4b27cb13285d316f9a56b87eb60f76bb697748a5569bf8c50b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5E59 | 10868 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.