MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.me'. The document body, though heavily obfuscated, contains the same URL and a lure related to 'Vampire Knight yuki death'. This indicates the PDF's primary purpose is to trick the user into visiting a malicious URL, likely for further exploitation or credential harvesting.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=vampire+knight+yuki+death
- https://cdn.shopify.com/s/files/1/0447/9765/7248/files/betazok.pdf
- https://cdn.shopify.com/s/files/1/0483/5750/7223/files/violin_open_strings_on_staff.pdf
- https://cdn.shopify.com/s/files/1/0437/4613/2119/files/94092568862.pdf
- https://fb00783e-3992-4750-8206-3dfd0144c340.filesusr.com/ugd/221eaa_6abd0f3415964528a9657a8502cd3116.pdf?index=true
- https://54f9f257-0f6d-4658-8734-21da9459970c.filesusr.com/ugd/3d0627_8e43c4210b0a4ffb8bb2ac8dd80b1e77.pdf?index=true
- https://7bf83921-0a9b-4e84-b153-bc191c53edab.filesusr.com/ugd/9c8fb9_e39f468619c042878a6d2d3af7890ee2.pdf?index=true
- https://f09e8c65-6f86-4bc9-a684-ccaae10e3cbb.filesusr.com/ugd/c8683e_3a04438a6c0b476dbad3bc678da263cf.pdf?index=true
- https://2d9f3f8c-af43-416d-bdc7-c23b679484d3.filesusr.com/ugd/c63dba_4e6c15ab3afa482fad21e2df1e8704dd.pdf?index=true
- https://41af2bc5-8291-452b-89bf-d984c0f1f1d1.filesusr.com/ugd/1e8759_92843db618484547938400a1b244b303.pdf?index=true
- https://6f3da1a6-f0c4-4584-9c2a-7db8e251850e.filesusr.com/ugd/bf0735_8c9a53911b6e44f28cfec7b5cc412b9c.pdf?index=true
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xasojikunu.pdf
- https://cdn.shopify.com/s/files/1/0465/4995/8806/files/87366851766.pdf
- https://cdn.shopify.com/s/files/1/0438/6599/7472/files/better_business_5th_edition_download.pdf
- https://cdn.shopify.com/s/files/1/0432/6876/7907/files/shoot_apical_meristem_pdf.pdf
- https://cdn.shopify.com/s/files/1/0433/9659/5861/files/zifoso.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d0ae.bin0789c88e10cb9d7cb6459f54ae6050c666ce05ec0656472aaaafd4e5e0f1602d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD0AE | 29808 bytes |
font_01_sfnt_off00012ca2.binfd663887c9337a3254eb685ede54299f317359af2603c61d89b28fedcf5c1709 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CA2 | 5292 bytes |
font_02_sfnt_off00013e84.bin87b4977d7ca04ca700b468329be62c4a4596c19ab893b3c3c05f7a9a0ff553dd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13E84 | 10244 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.