MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=bootstrapping+your+business+greg+gianforte+pdf'. This URL is embedded within the document body, suggesting a social engineering lure. The PDF also contains a link farm heuristic, indicating a large number of outbound links, many of which point to benign Shopify URLs, but the primary redirector is malicious. No scripts were extracted from this sample.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=bootstrapping+your+business+greg+gianforte+pdf
- http://files.hr-conference.org/uploads/1/3/1/3/131380889/dudaze_fodifef_xakomivuz.pdf
- http://files.solconenergy.com/uploads/1/3/0/7/130775084/2936037.pdf
- http://files.bjswoodcreations.com/uploads/1/3/0/8/130814586/tufoluta.pdf
- http://files.theweeklybeaver.com/uploads/1/3/1/4/131482821/vijebubenef-joripag-kemimevagid.pdf
- http://files.verarey.com/uploads/1/3/1/4/131406582/091a98a45e.pdf
- https://cdn.shopify.com/s/files/1/0429/6369/7817/files/cfa_level_1_study_material.pdf
- https://cdn.shopify.com/s/files/1/0433/7179/0494/files/becker_cpa_review.pdf
- https://cdn.shopify.com/s/files/1/0434/8759/2608/files/biblioteca_de_alejandria_libros.pdf
- https://cdn.shopify.com/s/files/1/0432/9403/2025/files/rugetuwife.pdf
- https://cdn.shopify.com/s/files/1/0435/1184/0927/files/rimunelix.pdf
- https://cdn.shopify.com/s/files/1/0434/4859/8678/files/54174161360.pdf
- https://cdn.shopify.com/s/files/1/0433/4606/7605/files/79831426783.pdf
- https://cdn.shopify.com/s/files/1/0447/8078/1719/files/pdf_file_splitter_download.pdf
- https://cdn.shopify.com/s/files/1/0429/9204/2137/files/guriwoxajojibifaxiv.pdf
- https://cdn.shopify.com/s/files/1/0428/0752/5542/files/masopimovimitateturonid.pdf
- https://cdn.shopify.com/s/files/1/0433/2378/5370/files/duxupaxoloxurep.pdf
- https://cdn.shopify.com/s/files/1/0430/7963/1012/files/63550632559.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000653e.bin092257ae29c1a47e190aa4d9079e370fc61f5cda00fc5f9e254ade93a2805706 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x653E | 5468 bytes |
font_01_sfnt_off000077e9.bind9609b0fb3b7039a54f1835c97f20a236522d29927b0751c4c3fc9af57a6d8a0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77E9 | 10320 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.