MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous external links, one of which is to a Shopify domain. The ML classifier also strongly indicated maliciousness. The primary attack vector appears to be social engineering via a deceptive document title and a malicious link.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=exemple+cahier+des+charges+logiciel+informatique
- http://bimunopo.dancebysanch.com/uploads/1/3/1/3/131383309/20b440de29a445e.pdf
- http://migajik.jason-molloy.com/uploads/1/3/0/7/130775432/xedusubefasiwa.pdf
- http://files.midnightsjourney.org/uploads/1/3/2/3/132302963/memazuwowe.pdf
- http://files.claytonpondhoa.com/uploads/1/3/0/8/130873795/9357871.pdf
- https://cdn.shopify.com/s/files/1/0437/2715/9448/files/infrastructure_as_code_iac_cookbook_download.pdf
- https://cdn.shopify.com/s/files/1/0431/8471/7979/files/kimavosawululapokol.pdf
- https://cdn.shopify.com/s/files/1/0429/5704/5913/files/varexek.pdf
- https://cdn.shopify.com/s/files/1/0430/6888/3098/files/autocad_import_text_recognition.pdf
- https://cdn.shopify.com/s/files/1/0436/9154/0634/files/wisixisademozotovejika.pdf
- https://cdn.shopify.com/s/files/1/0438/0337/7824/files/mechanical_engineering_drawing_standards.pdf
- https://cdn.shopify.com/s/files/1/0433/7899/9446/files/famifejajebakorij.pdf
- https://cdn.shopify.com/s/files/1/0457/3347/8566/files/34542343811.pdf
- https://cdn.shopify.com/s/files/1/0435/2707/8052/files/lagu_cinta_luar_biasa_karaoke_akustik.pdf
- https://cdn.shopify.com/s/files/1/0431/1308/7142/files/87361666089.pdf
- https://cdn.shopify.com/s/files/1/0435/0358/3384/files/dikabisilewi.pdf
- https://cdn.shopify.com/s/files/1/0435/1829/6232/files/cengage_coordinate_geometry_free.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0438
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000064cc.bin48859975517827c28f4b206a285f571cd7d0114730c5ea9f6b219cc1328bafda |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x64CC | 5720 bytes |
font_01_sfnt_off00007817.bin7f27727d19be3197140a6c2e7fee92964dc1ee41274a3c8c3477cbad75b307c7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7817 | 11560 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.