MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. This indicates the document's primary purpose is to redirect users to malicious infrastructure. Additionally, a PDF link farm heuristic suggests the document is part of a larger SEO-based distribution scheme. The embedded URLs and the document body content, though partially corrupted, reinforce the presence of links intended to lure users.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=borg+rating+of+perceived+exertion+rpe+scale+pdf
- http://gafino.melaniebartelart.com/uploads/1/3/0/8/130873826/podifekobodin.pdf
- http://files.victorytabernacle-franklin.org/uploads/1/3/1/4/131406841/3702887.pdf
- http://files.airmgmt.co/uploads/1/3/0/9/130969614/gafutinu_kofumekajo.pdf
- http://files.sqftestwo.com/uploads/1/3/0/7/130775506/5771692.pdf
- http://files.woozeyacresllc.com/uploads/1/3/1/6/131606257/rigalitutuxiku.pdf
- https://cdn.shopify.com/s/files/1/0435/6915/2163/files/80s_country_music.pdf
- https://cdn.shopify.com/s/files/1/0437/7952/2714/files/49931700242.pdf
- https://cdn.shopify.com/s/files/1/0433/8191/5804/files/88041084773.pdf
- https://cdn.shopify.com/s/files/1/0434/3798/1852/files/18593399563.pdf
- https://cdn.shopify.com/s/files/1/0431/2226/2178/files/gexadisitipaxuramag.pdf
- https://cdn.shopify.com/s/files/1/0441/1555/8552/files/9725961216.pdf
- https://cdn.shopify.com/s/files/1/0434/7029/1096/files/byculla_to_bangkok_free_download.pdf
- https://cdn.shopify.com/s/files/1/0431/6404/1373/files/69729630250.pdf
- https://cdn.shopify.com/s/files/1/0430/3847/4397/files/74209302959.pdf
- https://cdn.shopify.com/s/files/1/0453/2440/2843/files/atkins_induction_meal_plan.pdf
- https://cdn.shopify.com/s/files/1/0438/4423/9510/files/apache_spark_tutorial_download.pdf
- https://cdn.shopify.com/s/files/1/0432/9252/4700/files/wemovisusobodunedotikiz.pdf
- https://cdn.shopify.com/s/files/1/0430/6560/6301/files/dowry_prohibition_act_1961_in_marathi.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/72710717911.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000080b6.bind5e4ad7f3e25a6141e24e28ef9b780a00d85a7f3326214eece3ee5cd9b98eb9f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x80B6 | 5500 bytes |
font_01_sfnt_off00009385.bin949b8b439c382a6f80aeb3c3565e20199004cbae34f07e4d1753a7768f25e5f1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9385 | 10788 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.