MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a large number of embedded links, suggesting a link farm designed to lure users to malicious sites. The ML classifier also strongly indicated maliciousness. The primary malicious URL identified is ttraff.ru, which is used in conjunction with a keyword related to a popular game, likely to increase click-through rates.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=warframe+foxglove+syandana
- https://cdn.shopify.com/s/files/1/0428/4219/4083/files/dictionary_english_for_pc_free.pdf
- https://cdn.shopify.com/s/files/1/0445/8138/8452/files/chief_business_development_officer_job_description.pdf
- https://cdn.shopify.com/s/files/1/0429/0756/6239/files/32411660108.pdf
- https://cdn.shopify.com/s/files/1/0439/2042/5115/files/definisi_xerostomia.pdf
- https://cdn.shopify.com/s/files/1/0430/0357/6481/files/rorapimetekog.pdf
- https://cdn.shopify.com/s/files/1/0432/4481/4500/files/doom_patrol_2019_parents_guide.pdf
- https://cdn.shopify.com/s/files/1/0432/2318/7614/files/35666264251.pdf
- https://cdn.shopify.com/s/files/1/0431/7180/7394/files/vatofuzejudogixunofijiru.pdf
- https://cdn.shopify.com/s/files/1/0430/9850/5369/files/nba_basketball_live_streaming_1._11_apk.pdf
- https://cdn.shopify.com/s/files/1/0437/3551/5290/files/gozovovixaz.pdf
- https://cdn.shopify.com/s/files/1/0434/8418/4728/files/cutting_and_tailoring_book.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/86526592296.pdf
- https://cdn.shopify.com/s/files/1/0432/5962/5627/files/rofuwi.pdf
- https://static.usrfiles.com/ugd/15ebe2_c7e80a16c00b411c9e5126281a643c68.pdf
- https://static.usrfiles.com/ugd/a59130_533c2c983133471594ced080ac1639ec.pdf
- https://static.usrfiles.com/ugd/b8c837_337eaea437404630ab88b982952dc62e.pdf
- https://static.usrfiles.com/ugd/b8c837_2e5fd569fe664e948182ac763e234286.pdf
- https://static.usrfiles.com/ugd/3649d2_6fd54fcb0d204808a424ab562a133e6a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008c53.bina3aa6cb676d8a80005d424e5bd4693d61c691150c817c0c6477e14a5c5198739 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8C53 | 5468 bytes |
font_01_sfnt_off00009ef5.bin230399dee89edef10977c8327dff4fe37203d9d0031a7fdeeffa14d7bdff4701 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9EF5 | 11032 bytes |
font_02_sfnt_off0000c40c.bin5c95f0f138e6563f3fe05d796e7af5f1b8c38b5c15804eb90b689ff14a672150 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC40C | 2764 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.