MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF document was flagged for containing a malicious redirector link and a link farm, indicating a probable phishing or malware distribution attempt. The primary malicious URL identified is https://ttraff.ru/wix?keyword=inorganic+nomenclature+worksheet. While the document body contains garbled text, the presence of numerous external links, many pointing to Shopify domains, suggests an attempt to obscure the malicious destination and potentially leverage benign-looking domains for distribution. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=inorganic+nomenclature+worksheet
- https://cdn.shopify.com/s/files/1/0432/1466/7934/files/65949870098.pdf
- https://cdn.shopify.com/s/files/1/0436/4923/7145/files/25807474032.pdf
- https://cdn.shopify.com/s/files/1/0433/6458/1525/files/top_mind_games_for_android.pdf
- https://cdn.shopify.com/s/files/1/0427/6230/5702/files/77371143793.pdf
- https://cdn.shopify.com/s/files/1/0437/9276/0994/files/8084550112.pdf
- https://static.usrfiles.com/ugd/1decf9_dd4c7fcfbfa34df986fb0afa5fc2eb71.pdf
- https://static.usrfiles.com/ugd/b8c837_ad9832d2efd24c09924b5cce1a436411.pdf
- https://static.usrfiles.com/ugd/be19e1_969e6b175bea4909b38c86915b1a9d1e.pdf
- https://cdn.shopify.com/s/files/1/0432/7872/9374/files/80856223737.pdf
- https://cdn.shopify.com/s/files/1/0466/3869/4565/files/apha_pharmacy_library.pdf
- https://cdn.shopify.com/s/files/1/0430/8090/8951/files/rokidodokolowerekenomipax.pdf
- https://static.usrfiles.com/ugd/b8c837_a15e2bb99a464cf48c44de4e05ca7842.pdf
- https://static.usrfiles.com/ugd/36f25b_78a205e33c95410b843e539db93959dd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0466/3869/4565/files/apha_ph
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000060f7.bin367eed799a764f6620720b0c60041e0205de00b38d6ff9343942de5124b34ca3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x60F7 | 5300 bytes |
font_01_sfnt_off00007364.bin4a7f2f073acd5b4a0f8c5ad696ae24eca19a589192f083156a24645673726595 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7364 | 5188 bytes |
font_02_sfnt_off000084e6.binde5d27b00c57e267b0f10cff82ca979dbfa86a32d60664cb12abdf574b4fe3d8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x84E6 | 9896 bytes |
font_03_sfnt_off0000a6df.binb50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA6DF | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.