Malware Insights
The PDF file contains a large number of embedded links, a technique often used in SEO link farms to artificially boost search engine rankings or to distribute malicious content. One of the embedded URLs, 'https://ttraff.me/wix?keyword=clubbers+guide+ibiza+2009', is flagged as a known malicious redirector. The document body, though heavily obfuscated, also contains this URL and references to other PDF files hosted on Shopify, suggesting a coordinated effort to distribute content through multiple links. The primary intent appears to be directing users to malicious infrastructure via the redirector.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=clubbers+guide+ibiza+2009
- https://cdn.shopify.com/s/files/1/0437/5789/5841/files/rolibobojuduwigidejezise.pdf
- https://cdn.shopify.com/s/files/1/0438/4056/9501/files/vifivemarowovujogawadaweg.pdf
- https://cdn.shopify.com/s/files/1/0432/9819/3566/files/masterpieces_library_architecture_design.pdf
- https://cdn.shopify.com/s/files/1/0435/4038/1855/files/38367431042.pdf
- https://static.usrfiles.com/ugd/b8c837_97d3df522ca3497f83e214402bf74fbb.pdf
- https://static.usrfiles.com/ugd/b8c837_82c4394a3f19487da9638d2a4cc288e7.pdf
- https://static.usrfiles.com/ugd/b8c837_8c4eed335fd642a4af7c3d861c14881c.pdf
- https://cdn.shopify.com/s/files/1/0432/9000/1572/files/35956368672.pdf
- https://cdn.shopify.com/s/files/1/0432/6935/7728/files/keneviwimafutu.pdf
- https://cdn.shopify.com/s/files/1/0431/4755/9067/files/jipudebujamomom.pdf
- https://cdn.shopify.com/s/files/1/0429/5943/7975/files/litterature_africaine_negritude.pdf
- https://cdn.shopify.com/s/files/1/0432/8387/3942/files/pdf_editor_app_for_android.pdf
- https://cdn.shopify.com/s/files/1/0427/6345/2583/files/drupal_commerce_registration_tutoria.pdf
- https://cdn.shopify.com/s/files/1/0435/0512/3493/files/99886787448.pdf
- https://cdn.shopify.com/s/files/1/0432/7217/5781/files/prisoner_of_zenda_chapter_1.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005523.bin9aa8835ebfecd87b5e661930f6ec342a69f2be6943090d8f994fafc74d4332d3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5523 | 5220 bytes |
font_01_sfnt_off000066e2.bin4f228ba19861472367689103ffa5a53ffee8989b61cd7deef335d6943a221def |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x66E2 | 14196 bytes |
font_02_sfnt_off000093bc.bina542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x93BC | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.