MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=oxford+phonics+spelling+dictionary+free'. The document body, though heavily obfuscated, also contains this URL and numerous other links hosted on 'static.usrfiles.com', suggesting a link farm or redirection strategy. The primary attack pattern involves tricking the user into clicking the malicious redirector URL, likely leading to a further stage of infection.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=oxford+phonics+spelling+dictionary+free
- https://static.usrfiles.com/ugd/760101_27b286a565bd474ba18d688c9ba2a327.pdf
- https://static.usrfiles.com/ugd/b8c837_e7636953b3c9450b99517d154c542f6f.pdf
- https://static.usrfiles.com/ugd/5fd5c1_fc3f87a0228b48c990ff3d89cbe4611f.pdf
- https://static.usrfiles.com/ugd/b8c837_3f727f6ac632499190095df9fa5c858d.pdf
- https://static.usrfiles.com/ugd/b8c837_98a330be0f8a412cbd134df2c0a42fea.pdf
- https://static.usrfiles.com/ugd/b8c837_aa2cf6b96ada42b1abdcefda0868898e.pdf
- https://static.usrfiles.com/ugd/c83fdb_a1099c0c88ff41f893089bcaf7595e3f.pdf
- https://static.usrfiles.com/ugd/dd4472_073e7e9afabc4ceab6fc626048ae336f.pdf
- https://static.usrfiles.com/ugd/902d29_4d3e73251171470e9f80bd92477fb202.pdf
- https://static.usrfiles.com/ugd/4b874d_c879647ea2d54cce8a9e3d333e6e9b0d.pdf
- https://static.usrfiles.com/ugd/ac51ce_b6c92d2733b64569886f7b598aaadd35.pdf
- https://static.usrfiles.com/ugd/3de8a6_dccdf76010804878803273be5e864a22.pdf
- https://static.usrfiles.com/ugd/74e905_d1a0046eb71c4e1f9d7bbe57826864c3.pdf
- https://static.usrfiles.com/ugd/77eba6_5364ad1bce944fc1be4e01c416ae8577.pdf
- https://cdn.shopify.com/s/files/1/0440/7335/3381/files/makutopiridodutogoxeg.pdf
- https://cdn.shopify.com/s/files/1/0436/4104/5145/files/reading_comprehension_for_advanced_esl_students.pdf
- https://cdn.shopify.com/s/files/1/0431/4028/4573/files/cinema_v2._0._5_apk.pdf
- https://cdn.shopify.com/s/files/1/0429/4954/2047/files/fekod.pdf
- https://cdn.shopify.com/s/files/1/0431/8376/7713/files/cateterismo_cardiaco_2020.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005bf2.bin3a2d63dc9adaee0c9867416261d965685249073563b57e8c9520994172037c7f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5BF2 | 5616 bytes |
font_01_sfnt_off00006f22.bine87b87ba3db678849d0492b13f83e6d7092b035c1574cfddfa84eb6c00367111 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6F22 | 10540 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.