MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/wix?keyword=tobuk+sniper+rifle'. The document body, though heavily obfuscated, contains text related to 'Tobuk sniper rifle' and the malicious URL, suggesting a lure. The presence of numerous embedded links, many pointing to Shopify, indicates a link farm strategy, likely to obscure the malicious redirector. The file is identified as a PDF, and the primary malicious IOC is the redirector URL.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=tobuk+sniper+rifle
- https://cdn.shopify.com/s/files/1/0435/2406/3392/files/bezulosusuzezesox.pdf
- https://cdn.shopify.com/s/files/1/0429/0812/3303/files/tevizoxejedarogoxokip.pdf
- https://cdn.shopify.com/s/files/1/0430/8575/8618/files/beginning_spanish_worksheets_for_adults.pdf
- https://cdn.shopify.com/s/files/1/0437/9744/6816/files/the_negative_trait_thesaurus.pdf
- https://cdn.shopify.com/s/files/1/0433/1352/8987/files/jepijiwejon.pdf
- https://static.usrfiles.com/ugd/3f0e57_873c5e4ce6354c28a1d0495cf92a745f.pdf
- https://static.usrfiles.com/ugd/2ca09c_ad012d7eab1f43d7bb7c13d23054d072.pdf
- https://static.usrfiles.com/ugd/850f07_ab6024ea04e04c41bc5a44f46b3c28b6.pdf
- https://static.usrfiles.com/ugd/b8c837_ddb00799029c4acb8438275100331ed0.pdf
- https://static.usrfiles.com/ugd/b8c837_b9767d14db0641d29797ede21fba75fc.pdf
- https://static.usrfiles.com/ugd/b8c837_6b9d02e285a54026bd3ac5b8948e1543.pdf
- https://static.usrfiles.com/ugd/b8c837_ec6ec52bfe7b475dbb40f2d89ce4ca12.pdf
- https://static.usrfiles.com/ugd/b8c837_4bf3d8c6071a45e3a927d926aac3c04e.pdf
- https://static.usrfiles.com/ugd/bf07b1_8b037dd1723c4416ba0a1ead4e0c00ca.pdf
- https://static.usrfiles.com/ugd/b5472a_3678ad138adf4c5dac529170f619074f.pdf
- https://static.usrfiles.com/ugd/b4a829_51d368bd460b45308f1cdc648acf6295.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000de9c.binae0de75691ab3571261a1484ec37ff1fa2a396f5526b500f9abb9a7ce0a125e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE9C | 5856 bytes |
font_01_sfnt_off0000f2bd.bin12f33bb3736d33e05bdbba132e03c6963fe31bd5d6a969170000b4e27f9f46bb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2BD | 4836 bytes |
font_02_sfnt_off00010331.bin5489fd84108e84af3806161f4892f9f7da73ae1345ddf85320a645c7b8e92aaf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10331 | 8224 bytes |
font_03_sfnt_off00011a0a.bin79cfeed0e738018b7d4f3d315a46ec8050869a39f92728686bbb13bddcef91cf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A0A | 16492 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.