MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
T1553.005 Security Software Installation
The PDF contains a malicious redirector link and a large number of external links, characteristic of SEO poisoning or phishing campaigns. It also includes instructions to disable security software and provides a password for an archive, indicating a multi-stage attack. The primary malicious URL identified is https://ttraff.cc/pify?keyword=abbyy+pdf+transformer+14, which likely leads to the next stage of the attack.
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Security software disable instruction high SE_SECURITY_BYPASSDocument instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=abbyy+pdf+transformer+14
- http://files.andersoncommercialrealestate.com/uploads/1/3/1/1/131164520/4314738.pdf
- http://files.angelsof97.com/uploads/1/3/1/8/131857152/7b3a67f8.pdf
- http://sipogeta.independentdrcme.net/uploads/1/3/1/1/131163658/getivosu-wuvosepakamaxo-bonenuz.pdf
- https://cdn.shopify.com/s/files/1/0436/0483/6515/files/libro_agorafobia.pdf
- https://cdn.shopify.com/s/files/1/0429/4190/7100/files/zujuzaremimipigafibodup.pdf
- https://cdn.shopify.com/s/files/1/0427/3831/9527/files/44578223954.pdf
- https://cdn.shopify.com/s/files/1/0439/2235/8427/files/fedawo.pdf
- https://cdn.shopify.com/s/files/1/0430/3365/7507/files/46869445054.pdf
- https://cdn.shopify.com/s/files/1/0438/5511/8501/files/nabamabu.pdf
- https://cdn.shopify.com/s/files/1/0432/1070/3010/files/7291765107.pdf
- https://cdn.shopify.com/s/files/1/0432/0156/0737/files/walupomozimorizazutomar.pdf
- https://cdn.shopify.com/s/files/1/0432/7079/9510/files/pikozowizazoxaxenivuvusej.pdf
- https://cdn.shopify.com/s/files/1/0430/9506/4730/files/cardiomyopathy_classification.pdf
- https://cdn.shopify.com/s/files/1/0433/3531/9702/files/duchess_of_malfi_modern_english_translation.pdf
- https://cdn.shopify.com/s/files/1/0429/6572/9429/files/fesivifuwepet.pdf
- https://cdn.shopify.com/s/files/1/0432/1011/3188/files/68445351039.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006ed5.bin3c2d5da173806a994a1e7a49350a03a3ea30b922d5b35561f2542979dbef62bd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6ED5 | 5524 bytes |
font_01_sfnt_off0000818c.bin35d56f4aa5c44f74be379c877b2ae584b8a6e8c8a4638edf37dea46975302c34 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x818C | 12688 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.