MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded links, many pointing to Shopify domains, suggesting an SEO poisoning or link farm tactic. One prominent link, 'https://ttraff.com/wix?keyword=chartek+7+application+manual+pdf', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'Chartek 7 application manual pdf' and the authoring application 'wkhtmltopdf', reinforcing the lure of a technical document. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=chartek+7+application+manual+pdf
- https://cdn.shopify.com/s/files/1/0433/4007/1070/files/96939019378.pdf
- https://cdn.shopify.com/s/files/1/0435/6079/6318/files/coordinate_grid_christmas_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0437/9767/6192/files/julexefijabikanelifu.pdf
- https://cdn.shopify.com/s/files/1/0429/1811/7543/files/31371561861.pdf
- https://cdn.shopify.com/s/files/1/0428/7853/3799/files/turiteku.pdf
- https://cdn.shopify.com/s/files/1/0433/3027/3448/files/rekagix.pdf
- https://cdn.shopify.com/s/files/1/0432/3246/0960/files/28422511336.pdf
- https://cdn.shopify.com/s/files/1/0437/6982/3383/files/rusofixulidikit.pdf
- https://cdn.shopify.com/s/files/1/0432/5054/8899/files/arcsight_tutorial.pdf
- https://cdn.shopify.com/s/files/1/0429/7277/4556/files/12707070898.pdf
- https://cdn.shopify.com/s/files/1/0438/4430/5061/files/xaxepakanuropodokuwek.pdf
- https://cdn.shopify.com/s/files/1/0430/8575/8618/files/back_button_anywhere_apk.pdf
- https://cdn.shopify.com/s/files/1/0449/1545/8215/files/new_delhi_metro_map_download.pdf
- https://cdn.shopify.com/s/files/1/0435/2701/2507/files/print_tensorflow_version.pdf
- https://cdn.shopify.com/s/files/1/0459/8648/0295/files/chromebook_google_play_store_pending.pdf
- https://cdn.shopify.com/s/files/1/0431/9592/4637/files/docker_run_interactive.pdf
- https://cdn.shopify.com/s/files/1/0429/1382/4927/files/briggs_and_stratton_5hp_outboard.pdf
- https://cdn.shopify.com/s/files/1/0429/1916/6119/files/98766937813.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005c13.bin9b4f061607425a629a706396d57249f3b57209e1e281ab4e92811e603113ff84 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5C13 | 5268 bytes |
font_01_sfnt_off00006dd8.bin14888cbff0bb0dc164661ea4e863d0aa1cbd1e21933016930cc5c877dcf771f2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6DD8 | 12360 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.