MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=interfolio+amcas+2019+or+2020'. This URL is likely part of a phishing or scam campaign designed to trick users into clicking through by presenting a search query. The document also contains a large number of embedded links, many of which are to benign-looking PDF files, suggesting a link farm or SEO poisoning tactic to improve search engine ranking for malicious content. No scripts were extracted from this sample.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=interfolio+amcas+2019+or+2020
- http://zopowozu.thehackney.com/uploads/1/3/1/8/131872203/6265473.pdf
- http://kewet.cornellactuarialsociety.com/uploads/1/3/0/9/130969627/rojikavugikilej-xavukoponupi-litix-vipewoduzafomom.pdf
- http://files.msschatz4thgrade.com/uploads/1/3/0/7/130775328/2e359f12f2d1429.pdf
- https://ff24bc90-15b7-4492-9844-d351c1effc96.filesusr.com/ugd/0a0016_596a5397f5f848b7b0b91e4a1594f9d3.pdf?index=true
- https://91e42c7a-d1e3-4173-915a-954f00dbef83.filesusr.com/ugd/162fe6_23d5bc18cc834cf396e84f3599ae6bbc.pdf?index=true
- https://bdd8dc8a-219e-49cb-95eb-0bdc69b010eb.filesusr.com/ugd/8acad3_60cff46ba51f49768f76219e23fb0d9c.pdf?index=true
- https://cdn.shopify.com/s/files/1/0434/8208/7576/files/advantages_of_technology_in_communication.pdf
- https://cdn.shopify.com/s/files/1/0433/1801/8203/files/instant_card_making_s.pdf
- https://cdn.shopify.com/s/files/1/0433/7188/8803/files/dokor.pdf
- https://cdn.shopify.com/s/files/1/0434/7923/6773/files/ripusi.pdf
- https://cdn.shopify.com/s/files/1/0430/1661/8145/files/goluwarikozixewigekuz.pdf
- https://cdn.shopify.com/s/files/1/0436/1850/0765/files/6135081192.pdf
- https://cdn.shopify.com/s/files/1/0432/6912/8354/files/abc_english_alphabet_song.pdf
- https://cdn.shopify.com/s/files/1/0432/0080/7070/files/16430328612.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007486.bindfd7f0241f3460326d573fd123fac62df174009299195689cf127f0bd9e46da4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7486 | 5232 bytes |
font_01_sfnt_off00008622.bin273900a91ba6d17aa3eb8164dd3be867058e96c7f7872f266ddf67b4a5f8dd14 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8622 | 10720 bytes |
font_02_sfnt_off0000aab8.bincd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAAB8 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.