MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.ru'. The document body, though heavily obfuscated, contains text related to 'Ludovico einaudi primavera sheet mus' and the malicious URL, suggesting a lure to disguise the malicious redirect. The PDF also contains a link farm heuristic, indicating a large number of embedded links, with the primary one being to a Shopify domain which is confirmed benign, but the initial redirector is malicious.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=ludovico+einaudi+primavera+sheet+mus
- https://cdn.shopify.com/s/files/1/0431/6931/7020/files/lotibasanedetukolupebimi.pdf
- https://cdn.shopify.com/s/files/1/0439/9906/8318/files/67077311416.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/97253363073.pdf
- https://cdn.shopify.com/s/files/1/0461/6437/7752/files/arteriovenous_malformation_mri_findings.pdf
- https://cdn.shopify.com/s/files/1/0429/3731/9590/files/33550220067.pdf
- https://cdn.shopify.com/s/files/1/0439/1777/0904/files/xuwezizamutikopopekul.pdf
- https://cdn.shopify.com/s/files/1/0457/3167/6326/files/59210057681.pdf
- https://cdn.shopify.com/s/files/1/0432/3734/3387/files/skyrim_taz_visual_overhaul.pdf
- https://cdn.shopify.com/s/files/1/0429/7896/7703/files/23980471308.pdf
- https://cdn.shopify.com/s/files/1/0429/4954/2041/files/58541333815.pdf
- https://static.usrfiles.com/ugd/b8c837_17d79c96c04b4b318c9b707972fb986f.pdf
- https://static.usrfiles.com/ugd/b8c837_6f776add4ca840e09c28e0fbe21611d0.pdf
- https://static.usrfiles.com/ugd/b8c837_c501d8fa13944c5da4245ccb5664cdc9.pdf
- https://static.usrfiles.com/ugd/374ce0_ac1251e1788a4daab61a1d429a976d31.pdf
- https://static.usrfiles.com/ugd/b8c837_bda96b91e62445049cbdeb2cb1c3580d.pdf
- https://cdn.shopify.com/s/files/1/0439/4385/4235/files/2000_mitsubishi_montero_sport_owners_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/7507/5225/files/39146654825.pdf
- https://cdn.shopify.com/s/files/1/0431/1705/2053/files/abirami_anthathi_english.pdf
- https://cdn.shopify.com/s/files/1/0440/7151/8373/files/administracion_de_gluconato_de_calcio.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0440/7151/83
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000566a.bin5f6b033afd3556a5d60eaec55f3e91680b7a020ca8f72da347b3a0a6bb499ad2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x566A | 5280 bytes |
font_01_sfnt_off0000683b.bin418bcc2f84aa8d40db34196542d547cf77fd421d36ab7612e2cf7e98ce078751 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x683B | 14984 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.