MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on Shopify, suggesting a link farm for SEO manipulation or to obscure malicious redirects. One critical heuristic identified a direct link to a known malicious redirector, ttraff.cc, which is used to obscure the final malicious destination. The document body, though heavily obfuscated, contains text related to a 'cell counter manual' and the redirector URL includes a keyword related to this, indicating a lure. No scripts were extracted from this sample.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=vicell+cell+counter+manual
- http://rinex.thisgirlstees.com/uploads/1/3/1/4/131438188/bbece063619d.pdf
- http://sekexo.smokymountaintax.com/uploads/1/3/0/7/130739561/1f83a4511.pdf
- http://xakil.samanthaeveyoga.com/uploads/1/3/0/8/130814328/ba3ce07eab1b.pdf
- http://boruzana.engineeringk12mass.org/uploads/1/3/0/7/130776031/96ec29.pdf
- http://files.domaplasma.com/uploads/1/3/1/1/131164534/gifuwubumip.pdf
- https://cdn.shopify.com/s/files/1/0439/8222/5566/files/agricola_family_edition.pdf
- https://cdn.shopify.com/s/files/1/0433/3256/7195/files/zujefijaverutubebuxo.pdf
- https://cdn.shopify.com/s/files/1/0434/1222/6200/files/proyecto_arquitectonico.pdf
- https://cdn.shopify.com/s/files/1/0434/6013/3031/files/black_s_law_dictionary_download_free.pdf
- https://cdn.shopify.com/s/files/1/0431/9202/5249/files/vuzibibepere.pdf
- https://cdn.shopify.com/s/files/1/0431/7885/2503/files/area_of_trapezoid_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0439/9998/5822/files/48331618054.pdf
- https://cdn.shopify.com/s/files/1/0434/6196/8025/files/rabilovunesupigugosubagu.pdf
- https://cdn.shopify.com/s/files/1/0427/6404/2396/files/sekedomiv.pdf
- https://cdn.shopify.com/s/files/1/0427/8062/3015/files/jisemipovujuxofajetuliduj.pdf
- https://cdn.shopify.com/s/files/1/0430/3863/8241/files/98482289751.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000653b.bin37912c7212d62a0ffb4395f81ee22f53ec1c11103063b657b0451245de5a4f32 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x653B | 4732 bytes |
font_01_sfnt_off0000752e.bin2563d6af0ed90c6638b7e245d87d81bd45870a9e21ea7ef4671b00e394e00156 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x752E | 10180 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.