MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a lure for downloading a game mod, which directs the user to the malicious URL ttraff.club. This URL is identified as a malicious redirector. The document also contains a large number of embedded links to other PDFs hosted on Shopify and static.usrfiles.com, suggesting a link farm or SEO poisoning tactic to drive traffic to the malicious redirector.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=game+android+mod+hack+offline
- https://cdn.shopify.com/s/files/1/0429/5963/4585/files/93263626555.pdf
- https://cdn.shopify.com/s/files/1/0431/8891/2290/files/87083665565.pdf
- https://cdn.shopify.com/s/files/1/0428/3557/4943/files/gojoriwatabifoban.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/tokon.pdf
- https://static.usrfiles.com/ugd/b8c837_b89d6a7b0aeb4f74a62d7157d893c49a.pdf
- https://static.usrfiles.com/ugd/868401_3cc9ba7243be4593a7b010bdd528e03b.pdf
- https://static.usrfiles.com/ugd/a891c0_32f89eb558164625b9e3abdca9bd4324.pdf
- https://static.usrfiles.com/ugd/3aee12_bf04134115994787ad9f7e92132a5b20.pdf
- https://static.usrfiles.com/ugd/7820d0_db0b135a97ed444fb6155b30dcb3b1df.pdf
- https://static.usrfiles.com/ugd/b8c837_d66afe21cc00428597701760439c116a.pdf
- https://static.usrfiles.com/ugd/ad2ade_def5877dc5d84c539cd3a6eb038486bd.pdf
- https://static.usrfiles.com/ugd/b926a8_7aa0f2dffa6b4121bd5bcccad9d85c61.pdf
- https://cdn.shopify.com/s/files/1/0432/9514/6139/files/57548065306.pdf
- https://cdn.shopify.com/s/files/1/0432/6899/7288/files/21500132748.pdf
- https://cdn.shopify.com/s/files/1/0433/4649/3591/files/blockchain_dns_firefox_android.pdf
- https://cdn.shopify.com/s/files/1/0439/5529/0270/files/zosonuzigibexubedume.pdf
- https://cdn.shopify.com/s/files/1/0429/5124/5987/files/guruwajevavolikipub.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000065a2.bind0a0a5f71088087c891abd841d5e659f9392a3fe63c5295d7988d3f74104705d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x65A2 | 5176 bytes |
font_01_sfnt_off00007718.bin37e1c3d10763b6c7fc7a038465dc7771ea4a1d5c10a48fb7f14fdd3416fdce8b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7718 | 10360 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.