MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious Link
T1059.003 Windows Command Shell
The PDF contains a malicious redirector link pointing to 'https://ttraff.me/wix?keyword=star+aligner+manual+2.6', which is a critical finding. Additionally, the document body contains text that instructs the user to copy or paste content into a shell, indicating an attempt to trick the user into executing commands. The PDF also hosts a large number of external links, many of which are benign, but the primary malicious link is the focus.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=star+aligner+manual+2.6
- https://5baed329-452a-4fc0-b7f0-71b41ae13d33.filesusr.com/ugd/b56239_94967dc3009943a08a1fb745887d8ea0.pdf?index=true
- https://15b1b932-be41-475c-a122-1ea6cc09c473.filesusr.com/ugd/d9f7b5_e489a573ba9145d3b53e2fe091918844.pdf?index=true
- https://2117a60c-7818-4c08-b9ba-80b5bc5e67f2.filesusr.com/ugd/9f69bd_a3ac8d50deb94818a97ed914afaf55eb.pdf?index=true
- https://4727580c-622a-4faf-aa68-2f7639973874.filesusr.com/ugd/5f5755_a5c514d3e6c24538adb331e55e31d911.pdf?index=true
- https://c89b0206-31c4-45f5-b8c4-9702a2b6a614.filesusr.com/ugd/b5973a_cd37ac80d9a14118b466b46a0ab9f2bd.pdf?index=true
- https://cdn.shopify.com/s/files/1/0429/7788/6371/files/38380988758.pdf
- https://cdn.shopify.com/s/files/1/0433/4141/4555/files/free_premium_templates_for_blogger.pdf
- https://55a65539-42a8-4a87-8926-53a499a3d204.filesusr.com/ugd/234f58_0a1d20f230e7455288b67aafbeb0f744.pdf?index=true
- https://33a448a5-627f-49f0-9a60-54d3fa7544ad.filesusr.com/ugd/e948c1_a120cbc8f95f43c991d0a13a0fc414e2.pdf?index=true
- https://37ca115e-fc79-48b9-930a-a13ca9b67442.filesusr.com/ugd/45fd81_938c0c1e59524e8296c6ae22df0fd306.pdf?index=true
- https://153f442b-ca6b-4065-b5fa-b1e9d67c9e46.filesusr.com/ugd/d2057d_f77b977e72bb48d2b77001496382f071.pdf?index=true
- https://bb6ba73e-f4eb-40ff-8753-280c6ec5f203.filesusr.com/ugd/83e24f_dbd03f8b1f3e4d4fa50978b8b41cbaa5.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- https://www.ncbi.nlm.nih.gov/pubmed/23
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000673d.bin4d00da1b63516850dbb7a5aa48b18d4527dc3bf4e9842563328bdcefada06aa6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x673D | 5248 bytes |
font_01_sfnt_off00007903.bin11948339f51eec11d4c44ecfba091276874458923addc2f963713141fa0ad271 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7903 | 13512 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.