MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF contains a mass external link farm and a specific malicious redirector link, indicating a social engineering attempt to trick the user into clicking. The heuristic 'SE_BROWSER_INSTALL_LURE' confirms the document's intent to deceive the user into installing something or visiting a link to view content. The primary malicious URL identified is ttraff.cc, which redirects to a page related to 'naruto shippuden opening 3 blue bird'.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=naruto+shippuden+opening+3+blue+bird
- https://static.usrfiles.com/ugd/71fd01_f2125258d78b44aa94f160bc3507b719.pdf
- https://static.usrfiles.com/ugd/b8c837_69260b6ea10e4c69897655aa39b009b2.pdf
- https://static.usrfiles.com/ugd/de60da_cffa64aa3d5b407b90921b3812f3f802.pdf
- https://cdn.shopify.com/s/files/1/0439/7400/0798/files/batezibufux.pdf
- https://cdn.shopify.com/s/files/1/0429/4891/9450/files/35657625948.pdf
- https://cdn.shopify.com/s/files/1/0432/1450/4093/files/41205127896.pdf
- https://cdn.shopify.com/s/files/1/0437/5409/4753/files/permutations_vs_combinations_worksheet_answers.pdf
- https://cdn.shopify.com/s/files/1/0434/8814/9654/files/chirosports_performance_rehab.pdf
- https://static.usrfiles.com/ugd/b8c837_5f5df364077b4c2c9bb7c1e71aeafdba.pdf
- https://static.usrfiles.com/ugd/7603ae_971c76789bd841d1872abede087a06a0.pdf
- https://static.usrfiles.com/ugd/98857b_23242d04a8cf436b9d72f41dc6041b41.pdf
- https://static.usrfiles.com/ugd/7c30af_237c1f1bf7644913813eb671509ef1b7.pdf
- https://static.usrfiles.com/ugd/79cb75_a4a961227d0846dba2cb7ff20d593e16.pdf
- https://static.usrfiles.com/ugd/af0aa9_4c40ac4baec14fcabccebcf2eefb2365.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006568.binf5d97f4c8bcf6f47111bc61430422f6ebe6956735c36157bb6675a41a16f9343 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6568 | 9556 bytes |
font_01_sfnt_off0000859f.bin1d4cfa129b4b3a6f7b97843f7ae7bf86409995bec8d86ff4eb92955f4cc39b0e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x859F | 5496 bytes |
font_02_sfnt_off0000983c.bina563a418c076be50154191da9fcbf61902d28a0a116bc53eee865a84c88300e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x983C | 10080 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.