MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 User Execution: Malicious Link
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits a PDF link farm pattern, suggesting SEO manipulation to attract clicks. The presence of a 'download button' lure further supports the malicious intent. The primary malicious IOC is the redirector URL, which is likely used to deliver a secondary payload.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=autodesk+design+review+2019+free
- https://cdn.shopify.com/s/files/1/0445/9390/5828/files/android_app_development_software.pdf
- https://cdn.shopify.com/s/files/1/0440/8963/9077/files/pathophysiology_of_congenital_heart_disease.pdf
- https://cdn.shopify.com/s/files/1/0437/4193/7818/files/doctor_strange_the_movie.pdf
- https://cdn.shopify.com/s/files/1/0433/4478/9669/files/cyclone_rake_xl_manual.pdf
- https://cdn.shopify.com/s/files/1/0437/1061/1605/files/californication_guitar.pdf
- https://cdn.shopify.com/s/files/1/0431/5417/8216/files/kadomekipaxivajisi.pdf
- https://cdn.shopify.com/s/files/1/0428/2961/1171/files/wuledoloripagido.pdf
- https://static.usrfiles.com/ugd/a2d007_7d71349da7894570b41123b671ca7735.pdf
- https://static.usrfiles.com/ugd/b8c837_99b0b72cad1e4a6c9c1a156e30f12876.pdf
- https://static.usrfiles.com/ugd/87b9a8_69adce3cf2e145d5a8aff6b764a8bc1a.pdf
- https://static.usrfiles.com/ugd/4b68be_da2a6dca2c464dfc990ecb1faa7905e6.pdf
- https://static.usrfiles.com/ugd/f3cb45_30683c71c788497397962f04917174f6.pdf
- https://static.usrfiles.com/ugd/8ab72e_70d188d5b9e04e879eb5ef775775a6b8.pdf
- https://static.usrfiles.com/ugd/77941b_1a4a3a699dd044158f8bb7bbd4091131.pdf
- https://static.usrfiles.com/ugd/b8c837_62efa845e940446e88105a7eda97732d.pdf
- https://static.usrfiles.com/ugd/b8c837_c7721a74e7c04820b2f17953fdbb5f10.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004da4.bin9be4867fff0aabfa1ffb917f6276c644cecb7685eccdcb0fa2de093c03ef8a09 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4DA4 | 5520 bytes |
font_01_sfnt_off0000609d.binc90c02b4353647a4dc8bea7af3519d230d54ac3f69964d77efff674c150911c2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x609D | 10368 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.