MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=frc+2019+update+suite+serial+number'. This URL is presented within the document body, suggesting a social engineering attempt to trick the user into clicking it. The document also contains a large number of embedded links to PDFs hosted on 'static.usrfiles.com', indicating a potential link farm or distribution mechanism.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=frc+2019+update+suite+serial+number
- https://static.usrfiles.com/ugd/ae15ca_ad6de90af34249268f71d9d61916d69a.pdf
- https://static.usrfiles.com/ugd/b8c837_d5dd5b56f6ec452c817aecb991107b83.pdf
- https://static.usrfiles.com/ugd/cd79e3_360cb89fab20401c9edacf9ec7c360c8.pdf
- https://static.usrfiles.com/ugd/b65acf_153257880b1d4948b340b064cb06ff9d.pdf
- https://static.usrfiles.com/ugd/5be868_b6109c7afa8a49ffbf694bbd31083d37.pdf
- https://static.usrfiles.com/ugd/64d889_d207e861ab0f43c98ccf04e3d1966968.pdf
- https://static.usrfiles.com/ugd/ae059d_a453fd8812dc4f43bf0539c4f8c999cb.pdf
- https://static.usrfiles.com/ugd/b8c837_4d0dcc6942254291ad08b1dd63b43c85.pdf
- https://static.usrfiles.com/ugd/760101_cdb75f040ef04a6cbafb5e214d4e34c3.pdf
- https://cdn.shopify.com/s/files/1/0431/6423/7988/files/partitioning_a_segment_worksheet_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0441/0913/6024/files/37804625329.pdf
- https://cdn.shopify.com/s/files/1/0430/4276/7001/files/37056168531.pdf
- https://cdn.shopify.com/s/files/1/0437/4682/0245/files/8593208321.pdf
- https://cdn.shopify.com/s/files/1/0437/2597/9797/files/bulajimiwosuvitaraguwi.pdf
- https://cdn.shopify.com/s/files/1/0440/1653/3654/files/busy_works_beats_chord_codes.pdf
- https://cdn.shopify.com/s/files/1/0437/3417/1813/files/download_tomb_of_annihilation.pdf
- https://cdn.shopify.com/s/files/1/0438/1625/5650/files/14446841451.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000075d9.bina8bdf1762340a25b2daa99e75a7415150bb18d6e63394c1508875efe258b10a2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x75D9 | 5568 bytes |
font_01_sfnt_off0000889b.bin38c683c420de91e9cda431c4cea7b20859fc41a5584b76b133c55822eec59cfd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x889B | 10740 bytes |
font_02_sfnt_off0000ad34.bin7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAD34 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.